mickhansen vulnerabilities

Products

• dottie.js 1

Latest mickhansen CVEs

Newest publication first

1. CVE-2026-27837 Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()

   Published 2026-02-26

   Critical·CVSS 9.8 EPSS 0.36%

   Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, allowing an attacke...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.