CVE-2026-27837 Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()
Attackers can bypass prototype pollution guards in Dottie by placing __proto__ in non-first path segments, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27837?
CVE-2026-27837 is a medium-severity code injection vulnerability in mickhansen dottie.js, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.
Weakness: CWE-1321
Which versions are affected by CVE-2026-27837?
2 open source packages ship an affected version, including dottie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dottie npm | From 2.0.4 | 2.0.7 |
dottie npm | From 2.0.4 | 2.0.7 |
Products include Dottie Project Dottie.
How do I fix CVE-2026-27837?
Upgrade dottie to 2.0.7 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-27837 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27837 exists.
Other vulnerabilities in mickhansen dottie.js
Sources
Also known as CLEANSTART-2026-BG28241, CLEANSTART-2026-TR92634, DEBIAN-CVE-2026-27837, GHSA-r5mx-6wc6-7h9w, UBUNTU-CVE-2026-27837.