PT-2026-22065 · Dottie · Dottie

76Embiid21 · Published 2023-06-10 · Updated 2026-02-26 · CVE-2026-27837

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dottie versions 2.0.4 through 2.0.6

Description dottie is a JavaScript library for nested object access and manipulation. Versions 2.0.4 through 2.0.6 contain an incomplete fix for a prototype pollution issue. The prototype pollution guard only validates the first segment of a dot-separated path, allowing attackers to bypass the protection by placing proto at any position other than the first. The dottie.set() and dottie.transform() functions are affected. Versions prior to 2.0.4 are vulnerable due to insufficient checks within the set() function and the current variable in the /dottie.js file.

Recommendations Update to dottie version 2.0.7 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-27837

GHSA-4GXF-G5GF-22H4

GHSA-R5MX-6WC6-7H9W

Affected Products

Dottie

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27837.json · Exploit
• 🔥 https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w · Exploit
• https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-27837 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27837 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26132 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-27837 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27837 · Security Note
• https://osv.dev/vulnerability/GHSA-4gxf-g5gf-22h4 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27837 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5mx-6wc6-7h9w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27837 · Vendor Advisory
• https://github.com/mickhansen/dottie.js · Note
• https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68 · Note