{"id":"CVE-2026-107353","aliases":["AZL-107078","CLSA-2026-1792757149","CLSA-2026-1792757262","CLSA-2026-1792759996","CLSA-2026-1792760030","DEBIAN-CVE-2026-107353","EUVD-2026-94579","GHSA-rj28-8w7x-jmqc","UBUNTU-CVE-2026-107353"],"status":"published","title":"traverse: set() can write to built-in prototypes via an untrusted path","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0028,"percentile":0.20732,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-10-07T19:35:15Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"TuxCare:npm","package":"traverse","fixed_in":["0.5.2-tuxcare.1","0.6.8-tuxcare.1","0.3.9-tuxcare.1","0.6.11-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2-tuxcare.0"},{"fixed":"0.5.2-tuxcare.1"}]}],"versions":["0.5.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.8-tuxcare.0"},{"fixed":"0.6.8-tuxcare.1"}]}],"versions":["0.6.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.9-tuxcare.0"},{"fixed":"0.3.9-tuxcare.1"}]}],"versions":["0.3.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.11-tuxcare.0"},{"fixed":"0.6.11-tuxcare.1"}]}],"versions":["0.6.11"]},{"source":"osv","ecosystem":"Debian:12","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.7+~0.6.32-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.7+~0.6.32-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.7+~0.6.32-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.1-1","0.6.6-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.6-1.1","0.6.6-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.6-2","0.6.6+~0.6.32-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.7+~0.6.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.7+~0.6.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-traverse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.7+~0.6.32-1"]}],"products":[{"vendor":"ljharb","product":"traverse"}],"references":[{"url":"https://github.com/ljharb/js-traverse/security/advisories/GHSA-rj28-8w7x-jmqc","tags":["vendor-advisory","advisory","report"]},{"url":"https://github.com/ljharb/js-traverse/commit/81ccab43e379cf42eb2a5f689630f7f79b3d71b8","tags":["patch","fix","report"]},{"url":"https://github.com/ljharb/js-traverse/commit/37a9ebd103d2a259c824c29cdcc3f0dfe1acffce","tags":["patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107353","tags":["web","advisory"]},{"url":"https://www.npmjs.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107353.json","tags":["advisory"]},{"url":"https://github.com/ljharb/js-traverse","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-107353","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-107353","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107353","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-107353","title":"traverse: set() can write to built-in prototypes via an untrusted path","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","status":"published","published":"2026-10-07T19:35:15.351Z","modified":"2026-10-07T20:37:09.233Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-94579","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","status":"published","published":"2026-10-07T19:35:15Z","modified":"2026-10-07T20:37:09Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:33.904651Z"}],"nvd":[{"id":"CVE-2026-107353","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","status":"published","published":"2026-10-07T20:17:11.86Z","modified":"2026-10-08T21:34:48.8Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:54.809359Z"}],"osv":[{"id":"CVE-2026-107353","title":"traverse: set() can write to built-in prototypes via an untrusted path","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","status":"published","published":"2026-10-07T19:35:15.351Z","modified":"2026-10-28T02:30:58.511078111Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"DEBIAN-CVE-2026-107353","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","status":"published","published":"2026-10-07T20:17:11.86Z","modified":"2026-10-09T09:47:27.816547764Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:49.381767Z"},{"id":"UBUNTU-CVE-2026-107353","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","status":"published","published":"2026-10-07T20:17:00Z","modified":"2026-10-17T12:59:48.05312542Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"AZL-107078","title":"CVE-2026-107353 affecting package js-jquery 3.5.0-4","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","status":"published","published":"2026-10-07T20:17:11Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"CLSA-2026-1792757149","title":"TuxCare security update for traverse (1 CVE)","description":"TuxCare rebuilt traverse to address 1 CVE. Fixed in 0.5.2-tuxcare.1.","status":"published","published":"2026-10-23T12:05:49Z","modified":"2026-10-23T13:45:35.530816742Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792757262","title":"TuxCare security update for traverse (1 CVE)","description":"TuxCare rebuilt traverse to address 1 CVE. Fixed in 0.6.8-tuxcare.1.","status":"published","published":"2026-10-23T12:07:42Z","modified":"2026-10-23T13:45:35.038059202Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792759996","title":"TuxCare security update for traverse (1 CVE)","description":"TuxCare rebuilt traverse to address 1 CVE. Fixed in 0.3.9-tuxcare.1.","status":"published","published":"2026-10-23T12:53:16Z","modified":"2026-10-23T19:15:06.69854388Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792760030","title":"TuxCare security update for traverse (1 CVE)","description":"TuxCare rebuilt traverse to address 1 CVE. Fixed in 0.6.11-tuxcare.1.","status":"published","published":"2026-10-23T12:53:50Z","modified":"2026-10-23T19:15:04.047111372Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}