Skip to content
OpenAdvisories

Product · ljharb

traverse

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-107353

    traverse: set() can write to built-in prototypes via an untrusted path

    traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primiti…

    ljharb traverse js-jquery node-traverse Debian Ubuntu Azure Linux