traverse (npm) CVE-2026-107353

The application must call traverse's set() with an attacker-controlled path array where the path crosses (or ends on) a primitive value - for example a path derived from an untrusted JSON body. Polluting String.prototype, Number.prototype, or Boolean.prototype requires only plain JSON data (e.g., ['name','__proto__','polluted']). Polluting the far higher-impact Object.prototype is NOT achievable with pure JSON and requires a non-data path segment, such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. LIMITING FACTORS: exploitation is gated entirely on the specific anti-pattern of feeding untrusted input directly as the set() path; typical usage with hardcoded or sanitized paths is unaffected, and affected versions are limited to 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11.

The vendor CVSS 4.0 score of 6.9 (Medium) with AV:N/AC:L/PR:N/UI:N suggests broad, low-friction exposure, but the impact metrics temper this sharply: VC:N (no confidentiality impact) and only VI:L/VA:L (low integrity and availability). No EPSS score was provided, the CVE is not listed in CISA KEV, and no POC flag is set, so there is no public exploit identified at time of analysis (the advisory does contain a demonstration payload, which is distinct from active exploitation). The most important nuance is a conflict between the headline network/unauthenticated vector and the real-world precondition: exploitation only matters if an application passes an attacker-controlled path directly into traverse's set(), which is an application-specific anti-pattern, not a default behavior of the library. Furthermore, the description is explicit that Object.prototype - the classic high-impact prototype-pollution target that typically enables RCE/auth-bypass gadgets - is NOT reachable with plain JSON data and requires an exotic non-data path segment (an object with a mutating toString, or a Proxy). Pure JSON input can only pollute String.prototype, Number.prototype, or Boolean.prototype, which materially limits practical blast radius. Net assessment: a real but moderate-priority issue - patch promptly where set() consumes untrusted paths, but this is not a drop-everything, wormable flaw, and the Medium CVSS reflects that reality rather than overstating it.

An application exposes functionality that derives a traverse().set() path from untrusted input (e.g., a JSON body or query parameter) and the path crosses a primitive value, such as traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). An attacker submits a crafted path that resolves the next segment on a primitive's built-in prototype, adding attacker-chosen properties to String.prototype, Number.prototype, or Boolean.prototype using plain JSON. No public exploit is identified at time of analysis, though the vendor advisory includes a demonstration payload; given AV:N/AC:L, exploitation is low-complexity wherever the vulnerable code path is exposed.