Seal Security

CVE-2023-26132

dottie vulnerable to Prototype Pollution

Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the `set()` function and the current variable in the `/dottie.js` file.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading

Vulnerability Details

Score

7.5

Score Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Versions

dottie < 2.0.4

Severity

High

Ecosystem

JavaScript

Publish Date

June 10, 2023

Modified Date

November 7, 2023