dot-access: Prototype pollution in set() via crafted dotted path
Summary
The npm library dot-access, up to and including version 1.0.0, does not filter prototype keys in its set() function. An attacker who controls the dotted path, for example through user-supplied field names, can use __proto__ segments to modify Object.prototype and thereby every object in the Node.js process. This can change authorization flags or option defaults, or crash the process. The package appears unmaintained and no fixed version is known.
Affected
- dot-access, versions 0 to 1.0.0 (per CVE record and aggregator sources)
Fixed in
Unknown. No fixed version or vendor statement has been found.
Workaround
- Do not pass untrusted input as dotted paths to set().
- If input must be accepted, reject paths containing __proto__, prototype or constructor.
- Check lockfiles with npm ls dot-access, as the package is often a transitive dependency.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS 0.00325.
- No evidence of known exploitation found.
- Public proof-of-concept status unverified.
Our recommendation
- Check whether dot-access is used directly or as a transitive dependency (npm ls dot-access, lockfiles, deployed manifests).
- Remove the package or replace it with a maintained alternative.
- Until then, make sure no untrusted input reaches set() as a dotted path.
- Monitor for an official fix and review NVD once the analysis is published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Maintainer issue #5 (ntharim/dot-access) github.com
- Vulnerable code at tag v1.0.0 github.com
- OSV record CVE-2026-107701 osv.dev
- HOL advisory feed hol.org
- Socket package report socket.dev
- npm package page www.npmjs.com
- Mend vulnerability record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:11.
Original description (NVD)
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
NVD references (5)
- https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2
- https://github.com/ntharim/dot-access
- https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18
- https://github.com/ntharim/dot-access/issues/5
- https://www.vulncheck.com/advisories/dot-access-through-1.0.0-prototype-pollution-via-set-path-argument
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.