CVE-2026-27837: Dottie prototype pollution bypass via non-first path segments in set() and transform()

Overview

Dottie is a JavaScript library for reading and modifying nested objects. CVE-2026-27837 describes an incomplete fix for CVE-2023-26132: the prototype pollution guard checks only the first segment of a dot-separated path, so it can be bypassed when the dangerous property name appears in a later segment. Both set() and transform() are reported as affected.

Impact

• Prototype pollution can modify properties shared across JavaScript objects, which may change application behavior. The severity of that effect in a given application is unknown from the record.
• NVD records a CVSS v3 base score of 9.8 (critical) with high impact ratings for confidentiality, integrity and availability. GitHub records 6.3 for the same issue.
• The assigned weakness is CWE-1321, Prototype Pollution.

Affected products and versions

• Dottie Project Dottie: from 2.0.4 before 2.0.7.
• Mickhansen Dottie.js: from 2.0.4 before 2.0.7.
• The record states that the incomplete guard is present in versions 2.0.4 through 2.0.6.
• The fixed version indicated by the description is 2.0.7.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation appears in the sources consulted. The SSVC data in the record lists exploitation as poc and automatable as no. The reference list includes an entry tagged as exploit-related, but its contents were not part of the analyzed data.

Remediation and mitigation

• Upgrade Dottie to 2.0.7 or a later release that the maintainer publishes.
• Review the maintainer advisory and the patch commit.
• Until upgrading, limit which untrusted input can reach path-based set() or transform() calls, and reject or sanitize property names that match prototype-related keys in any path segment.
• Re-test after the upgrade that protected paths behave as expected at every segment position.

Detection guidance

• Inventory dependency manifests and lockfiles for Dottie installations in the range from 2.0.4 before 2.0.7.
• Review application logs or input validation records for path strings containing unusual property names in non-first positions.
• Monitor for unexpected changes to object prototypes or default properties in application behavior.

Limitations of the available information

• The record includes the fix commit only as a link and does not describe its code changes in detail.
• NVD (9.8) and GitHub (6.3) assign different CVSS scores, and the reason for the difference is not stated.
• The record does not include proof-of-concept details, and the EPSS probability of 0.0055 is a statistical estimate rather than evidence of exploitation.
• Whether version 2.0.7 fully resolves the residual issue is taken from the description and was not independently verified.

Frequently asked questions

What is the vulnerability in Dottie CVE-2026-27837?

The prototype pollution guard checks only the first segment of a dot-separated path, so the protection can be bypassed when the dangerous property name appears in a later segment. Both set() and transform() are reported as affected.

Which versions are affected?

The record lists affected products as from 2.0.4 before 2.0.7 for both Dottie Project Dottie and Mickhansen Dottie.js. The fixed version indicated is 2.0.7.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation appears in the sources consulted. SSVC data in the record lists exploitation as poc.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.