Skip to content
OpenAdvisories

Package · Debian

node-traverse

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-107353

    traverse: set() can write to built-in prototypes via an untrusted path

    traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primiti…

    ljharb traverse node-traverse node-traverse Debian Ubuntu