CVE-2026-107701: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in ntharim dot-access

CVE-2026-107701 describes a prototype pollution vulnerability in the dot-access library through version 1.0.0. The vulnerability arises because the set() function improperly controls modification of Object.prototype when attackers supply crafted dotted paths containing __proto__ segments. This enables attackers to inject or modify properties globally across all objects, which can impact application logic such as authorization or configuration defaults, or cause instability by crashing the process.

Successful exploitation allows attackers to modify Object.prototype, affecting all objects in the environment. This can lead to unauthorized privilege escalation by altering authorization flags, changing default options that affect application behavior, or causing denial of service via process crashes. The CVSS 4.0 score of 8.8 (high severity) reflects the network attack vector, no required privileges or user interaction, and high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input as dotted paths to the set() function in dot-access. Implement input validation or sanitization to prevent __proto__ segments in user-supplied paths.