CVE-2026-107701
HIGH 8.8dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
Severe if exploited (CVSS 8.8), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 25th percentile
Impact if exploited
8.8CVSS 4.0 · HIGH
- ConfidentialityNone
- IntegrityHigh
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- HIGH 8.8 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - HIGH 8.2 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - HIGH 8.8 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - HIGH 8.2 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
References
Advisories
- https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2 CVE record · VulnCheck · Updated 2026-10-08T18:36:36.315Z
NVD · CVE-2026-107701 · Updated 2026-10-14T17:18:17.790 - https://www.vulncheck.com/advisories/dot-access-through-1.0.0-prototype-pollution-via-set-path-argument CVE record · VulnCheck · Updated 2026-10-08T18:36:36.315Z
NVD · CVE-2026-107701 · Updated 2026-10-14T17:18:17.790 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95147 EUVD · EUVD-2026-95147
Technical & other
- https://github.com/ntharim/dot-access/issues/5 CVE record · VulnCheck · Updated 2026-10-08T18:36:36.315Z
NVD · CVE-2026-107701 · Updated 2026-10-14T17:18:17.790 - https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18 CVE record · VulnCheck · Updated 2026-10-08T18:36:36.315Z
NVD · CVE-2026-107701 · Updated 2026-10-14T17:18:17.790 - https://github.com/ntharim/dot-access CVE record · VulnCheck · Updated 2026-10-08T18:36:36.315Z
NVD · CVE-2026-107701 · Updated 2026-10-14T17:18:17.790