dot-access: Code injection in get() via crafted path argument
Summary
The npm package dot-access from version 0.0.3 through 1.0.0 builds a JavaScript Function from the path argument of get(). A remote attacker who can control this path can run arbitrary JavaScript and operating system commands in the Node.js process. The CVE record rates this as CRITICAL (CVSS 4.0: 9.3), and the risk is indirect: it applies only to applications that pass attacker-controlled input to get().
Affected
- dot-access 0.0.3 through 1.0.0 (per CVE record; default status unaffected)
Fixed in
- Unknown. OSV lists fix commit 371c786a9038c6ddeba12c852b86aabe5292df79, but no released version containing it has been confirmed.
- No vendor advisory found.
Workaround
- Do not pass user-controlled input to get() in affected versions.
- Remove the package where it is not needed, or pin it away from affected versions.
- Validate any data passed to get() as a safeguard.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable yes, technical impact total.
- A public proof-of-concept gist is referenced in the CVE record; its contents have not been reviewed.
- Not listed in CISA KEV; no evidence of exploitation in the wild found.
- EPSS 0.00501 (low).
Our recommendation
- Run 'npm ls dot-access' or check lockfiles across all projects to identify affected installations, including transitive dependencies.
- Prioritise internet-facing Node.js applications that use the package with user-controlled paths, such as form fields or query parameters.
- Remove or restrict the affected functionality until a fixed release is confirmed.
- Monitor the GitHub repository and OSV entry for a release containing the fix, and apply it promptly.
- Review application logs for unusual path inputs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- GitHub repository ntharim/dot-access github.com
- Vulnerable code index.js (v1.0.0) github.com
- Public write-up gist (R3tro16) gist.github.com
- OSV entry CVE-2026-107700 osv.dev
- Strix CVE-2026-107700 www.strix.ai
- VulDB 415530 vuldb.com
- Vulners VulnCheck/Vulnrichment CVE-2026-107700 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:55.
Original description (NVD)
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.
NVD references (5)
- https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2
- https://github.com/ntharim/dot-access
- https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L1-L7
- https://www.vulncheck.com/advisories/dot-access-0.0.3-through-1.0.0-code-injection-via-get-path-argument
- https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.