Dot Access
Monthly
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
Remote code execution in dot-access versions 0.0.3 through 1.0.0 allows unauthenticated attackers to execute arbitrary JavaScript and operating system commands when a consuming application passes attacker-controlled input as the path argument to the get() function. The vulnerability arises from unsanitized path concatenation into a dynamically constructed Function body, enabling access to constructor.constructor and child_process. No public exploit code was identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact. Exploitation is conditional on untrusted input reaching get().
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
Remote code execution in dot-access versions 0.0.3 through 1.0.0 allows unauthenticated attackers to execute arbitrary JavaScript and operating system commands when a consuming application passes attacker-controlled input as the path argument to the get() function. The vulnerability arises from unsanitized path concatenation into a dynamically constructed Function body, enabling access to constructor.constructor and child_process. No public exploit code was identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact. Exploitation is conditional on untrusted input reaching get().