PT-2026-22065 · Dottie · Dottie

76Embiid21 · Publicado 2023-06-10 · Atualizado 2026-02-26 · CVE-2026-27837

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dottie versions 2.0.4 through 2.0.6

Description dottie is a JavaScript library for nested object access and manipulation. Versions 2.0.4 through 2.0.6 contain an incomplete fix for a prototype pollution issue. The prototype pollution guard only validates the first segment of a dot-separated path, allowing attackers to bypass the protection by placing proto at any position other than the first. The dottie.set() and dottie.transform() functions are affected. Versions prior to 2.0.4 are vulnerable due to insufficient checks within the set() function and the current variable in the /dottie.js file.

Recommendations Update to dottie version 2.0.7 or later.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-27837

GHSA-4GXF-G5GF-22H4

GHSA-R5MX-6WC6-7H9W

Produtos afetados

Dottie

Referências · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27837.json · Exploit
• 🔥 https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w · Exploit
• https://github.com/mickhansen/dottie.js · Nota
• https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14 · Correção
• https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68 · Nota
• https://github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js#L107 · Nota
• https://twitter.com/CVEnew/status/2027004245644370212 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-27837 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27837 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-27837 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26132 · Nota de Segurança
• https://github.com/advisories/GHSA-4gxf-g5gf-22h4 · Nota
• https://cve.org/CVERecord?id=CVE-2026-27837 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-27837 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1rfmr3t/resumen_diario_de_vulnerabilidades_26022026 · Publicação no Reddit