CVE-2023-26132
dottie vulnerable to Prototype Pollution
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Record
CVE-2023-26132- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P - Weakness
- CWE-1321, CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2023-1688
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Record
EUVD-2023-1688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4gxf-g5gf-22h4
dottie vulnerable to Prototype Pollution
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Record
GHSA-4gxf-g5gf-22h4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
NVD
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Record
CVE-2023-26132- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Record
CVE-2023-26132- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-26132
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Record
DEBIAN-CVE-2023-26132- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-4gxf-g5gf-22h4
dottie vulnerable to Prototype Pollution
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Record
GHSA-4gxf-g5gf-22h4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2023-26132
CVE-2023-26132 in dottie - Patched by Root
Root has patched CVE-2023-26132 in the dottie package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2023-26132- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
OSVUBUNTU-CVE-2023-26132
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Record
UBUNTU-CVE-2023-26132- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-8041-1 No score
node-dottie vulnerability
Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype pollution when altering the proto magical attribute. An attacker could possibly use this issue to achieve remote code execution.
- Record
USN-8041-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dottienpm |
before 2.0.4 | 2.0.4 |
node-dottieDebian:12 |
before 2.0.2-4+deb12u1, plus listed versions 2.0.2-4 |
2.0.2-4+deb12u1 |
node-dottieDebian:13 |
before 2.0.6+~2.0.5-1 | 2.0.6+~2.0.5-1 |
node-dottieDebian:14 |
before 2.0.6+~2.0.5-1 | 2.0.6+~2.0.5-1 |
dottieRoot:npm |
before 2.0.2-aikido.1 | 2.0.2-aikido.1 |
@rootio/dottieRoot:npm |
before 2.0.2-root.io.1 | 2.0.2-root.io.1 |
node-dottieUbuntu:Pro:20.04:LTS |
before 2.0.2-1ubuntu0.1~esm1, plus listed versions 2.0.2-1 |
2.0.2-1ubuntu0.1~esm1 |
node-dottieUbuntu:Pro:22.04:LTS |
before 2.0.2-4ubuntu0.1~esm1, plus listed versions 2.0.2-12.0.2-32.0.2-4 |
2.0.2-4ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-26132 is a high vulnerability (CVSS 7.5) in Dottie Project Dottie, published June 10, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in dottie 2.0.4.
References
security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763
github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js%23L107
nvd.nist.gov/vuln/detail/CVE-2023-26132