CVE-2026-107701

Summary

The vulnerability allows attackers to pollute JavaScript object prototypes through crafted dotted paths, enabling them to inject properties into all objects and potentially alter authorization behavior or crash processes. This affects applications using the dot-access library version 1.0.0.

Exploitability

Exploitation is relatively straightforward for attackers who can control field names or input paths, requiring only a single crafted dotted path with __proto__ segments to modify Object.prototype.

Blast radius

The impact could be significant across applications using this library, potentially affecting authorization controls, default configurations, and process stability if exploited at scale.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to dot-access version 1.0.1 or later to address the prototype pollution vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.