High severity · published Jun 10, 2023
CVE-2023-26132
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js…
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dottie ·
before 2.0.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26132
Broken Link
https://github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js%23L107
Patch
https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68
Exploit
https://security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763