[ CVE-2026-107701 · Published 8 Oct 2026 ]
Vulnerability in ntharim dot-access
CVSS 8.2
EPSS <1%No fix listed yet
[ Description ]Official description
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.