CVE-2026-27837

A flaw was found in dottie.js, a JavaScript library for nested object access and manipulation. An incomplete fix for a previous vulnerability allows a remote attacker to bypass prototype pollution protection by placing 'proto' at any position other than the first in a dot-separated path. This vulnerability affects the dottie.set() and dottie.transform() functions. Successful exploitation can lead to unauthorized modification of object properties, potentially causing unexpected application behavior, information disclosure, or denial of service.

This vulnerability is rated as Moderate by Red Hat. Successful exploitation requires user interaction, since the two vulnerable functions, dottie.set() and dottie.transform(), first need to be passed an accepted attacker-controlled input (ex. by parsing a query string). Furthermore, the result of a successful exploitation may result in limited and indirect leakage of sensitive data (largely dependent upon the context in which the application is used), limited integrity impact (since the attack does not allow for arbitrary memory or code overwriting), and limited availability impact potentially causing the application to crash (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project has released dottie.js version 2.0.7, which contains an updated fix for this issue.