CVE-2026-107353 traverse: set() can write to built-in prototypes via an untrusted path
Attackers can pollute built-in prototypes via untrusted paths in the traverse library, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107353?
CVE-2026-107353 is a medium-severity code injection vulnerability in ljharb traverse, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Weakness: CWE-1321
Which versions are affected by CVE-2026-107353?
How do I fix CVE-2026-107353?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-107353 being exploited?
There is no known exploitation of CVE-2026-107353 in the wild and no public exploit code.
Sources
Also known as AZL-107078, CLSA-2026-1792757149, CLSA-2026-1792757262, CLSA-2026-1792759996, CLSA-2026-1792760030, DEBIAN-CVE-2026-107353 and 2 more.