p PatchFirst

CVE-2023-26132

CVE-2023-26132

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

CVSS 7.5 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • dottie

    Versions
    • ≥ 0, < 2.0.4: Affected (semver)

    Update to 2.0.4

  • node-dottie Debian:12

    Versions
    • 2.0.2-4
    Affected ranges
    • ECOSYSTEM: < 2.0.2-4+deb12u1

    Update to 2.0.2-4+deb12u1

  • node-dottie Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.0.6+~2.0.5-1

    Update to 2.0.6+~2.0.5-1

  • node-dottie Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.0.6+~2.0.5-1

    Update to 2.0.6+~2.0.5-1

  • dottie npm

    Affected ranges
    • SEMVER: < 2.0.4

    Update to 2.0.4

  • node-dottie Ubuntu:Pro:20.04:LTS

    Versions
    • 2.0.2-1
    Affected ranges
    • ECOSYSTEM: < 2.0.2-1ubuntu0.1~esm1

    Update to 2.0.2-1ubuntu0.1~esm1

  • node-dottie Ubuntu:Pro:22.04:LTS

    Versions
    • 2.0.2-1
    • 2.0.2-3
    • 2.0.2-4
    Affected ranges
    • ECOSYSTEM: < 2.0.2-4ubuntu0.1~esm1

    Update to 2.0.2-4ubuntu0.1~esm1

Original sources

Check your server →