Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-zgdm-kze3-zydf
Vulnerability ID VCID-zgdm-kze3-zydf
Aliases CVE-2026-27837
GHSA-r5mx-6wc6-7h9w
Summary Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27837.json
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2026-27837
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2026-27837
cvssv3.1 6.3 https://github.com/advisories/GHSA-4gxf-g5gf-22h4
generic_textual MODERATE https://github.com/advisories/GHSA-4gxf-g5gf-22h4
ssvc Track https://github.com/advisories/GHSA-4gxf-g5gf-22h4
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-r5mx-6wc6-7h9w
cvssv3.1 6.3 https://github.com/mickhansen/dottie.js
generic_textual MODERATE https://github.com/mickhansen/dottie.js
cvssv3.1 6.3 https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
generic_textual MODERATE https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
ssvc Track https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
cvssv3.1 6.3 https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
cvssv3.1_qr MODERATE https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
generic_textual MODERATE https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
ssvc Track https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
cvssv3.1 6.3 https://nvd.nist.gov/vuln/detail/CVE-2026-27837
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-27837
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27837.json
https://api.first.org/data/v1/epss?cve=CVE-2026-27837
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27837
https://github.com/mickhansen/dottie.js
1129097 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129097
2442905 https://bugzilla.redhat.com/show_bug.cgi?id=2442905
7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14 https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
CVE-2026-27837 https://nvd.nist.gov/vuln/detail/CVE-2026-27837
GHSA-4gxf-g5gf-22h4 https://github.com/advisories/GHSA-4gxf-g5gf-22h4
GHSA-r5mx-6wc6-7h9w https://github.com/advisories/GHSA-r5mx-6wc6-7h9w
GHSA-r5mx-6wc6-7h9w https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27837.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/advisories/GHSA-4gxf-g5gf-22h4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:40:01Z/ Found at https://github.com/advisories/GHSA-4gxf-g5gf-22h4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/mickhansen/dottie.js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:40:01Z/ Found at https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:40:01Z/ Found at https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-27837
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.37272
EPSS Score 0.00165
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:50:51.794766+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/27xxx/CVE-2026-27837.json 38.6.0