CVE-2023-45827
HIGHClickbar Dot-diver < 1.0.2 - Prototype Pollution
Title source: ruleDescription
Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.
Exploits (1)
Scores
CVSS v3
7.3
EPSS
0.0960
EPSS Percentile
92.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-1321
Status
published
Products (2)
clickbar/dot-diver
< 1.0.2
clickbar/dot-diver
0 - 1.0.2npm
Published
Nov 06, 2023
Tracked Since
Feb 18, 2026