CVE-2026-107353: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in ljharb traverse

The ljharb traverse package suffers from a prototype pollution vulnerability (CWE-1321) in multiple version ranges. The issue arises when the set() method is called with a path that crosses a primitive value, causing the next path segment to resolve on the primitive's built-in prototype. This allows an attacker who can supply an untrusted path to set() to add or overwrite properties on prototypes such as String.prototype, Number.prototype, or Boolean.prototype. Object.prototype is not directly reachable except through complex non-data paths. The vulnerability is addressed in versions 0.3.10, 0.4.7, 0.5.3, and 0.6.12.

An attacker able to supply untrusted input to the set() function can perform prototype pollution on built-in JavaScript prototypes, potentially leading to unexpected behavior or security issues in applications using the vulnerable versions of traverse. The impact is limited to prototype pollution of primitive prototypes and does not directly affect Object.prototype under normal conditions. No known exploits in the wild have been reported.

Upgrade to traverse versions 0.3.10, 0.4.7, 0.5.3, or 0.6.12 or later, where this prototype pollution vulnerability is fixed. No other mitigation is required as the fix is official and available.