TI-2026-22188 CVE-2026-27837 · GHSA-r5mx-6wc6-7h9w
Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()
Priority HIGH 75
Dottie provides nested object access and manipulation in JavaScript.
Dottie Project
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Dottie Project records in CISA KEVNo Dottie Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
2 records
TI-2023-11356 CVE-2023-26132 · GHSA-4gxf-g5gf-22h4
Prototype pollution in dottie
Priority HIGH 72
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.