dot-access EUVD-2026-95147

Exploitation requires a consuming application to call dot-access's set() with an attacker-influenced dotted path - specifically a path whose segments include '__proto__' (e.g., user-supplied field names, JSON keys, or form parameters flowing unsanitized into set()). Per the provided CVSS 4.0 vector (PR:N/UI:N/AC:L), no authentication or user interaction is modeled at the library boundary, but the real limiting factor is integration-specific: the flaw is only reachable when untrusted input controls the path argument. Applications that only pass trusted, static, or validated keys to set() are not exposed. Impact is prototype pollution affecting authorization flags and option defaults (integrity) or a process crash (availability/DoS).

This is a prototype pollution flaw (CWE-1321) in the npm library dot-access (vendor slug 'ntharim') affecting all versions through 1.0.0. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VI:H and VA:L yields a base score of 8.8, signaling network-reachable, low-complexity exploitation with high integrity impact and a lesser availability (DoS) impact, and no confidentiality impact (VC:N). A public proof-of-concept exists (R3tro16 gist), so publicly available exploit code exists; however there is no CISA KEV listing and no EPSS score in the provided data, so there is no confirmed active exploitation and no modeled exploitation probability to corroborate the high CVSS. The most important caveat: this is a library vulnerability whose reachability is entirely contingent on a consuming application passing attacker-controlled input as the dotted path to set(). The PR:N/AV:N rating therefore describes the worst-case integration (user-supplied field names flow into set()), not an intrinsic remote entry point of the library itself. Net assessment: the real-world priority is moderated heavily by prevalence - dot-access is an obscure, tiny-footprint package with no enterprise deployment signal - so despite the high integrity impact and available POC, this is a targeted-dependency concern rather than a widespread emergency. Teams should prioritize it only if dot-access appears in their dependency tree and feeds untrusted keys to set().

An application uses dot-access's set() to map user-submitted field names (e.g., from a JSON body or form) into a nested configuration or user object. An attacker submits a field name containing a '__proto__' segment such as '__proto__.isAdmin', polluting Object.prototype so that all objects inherit the injected property - flipping an authorization flag or an option default, or supplying a value type that later crashes the process (DoS). A public proof-of-concept is available in the referenced gist.