CVE-2026-107353: traverse: set() can write to built-in prototypes via an untrusted path
traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', 'proto', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/traverseto a version that resolves this vulnerability.Fixed in 0.6.12
Event History
Frequently Asked Questions
Which applications are exposed to exploitation?
An application is exposed if it uses an affected traverse version and passes attacker-controlled path segments to set(). The path must cross a primitive value such as a string, number, or boolean in the traversed data.
Can this be exploited using ordinary JSON input?
Yes. Plain JSON data can be used to add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an untrusted path reaches a primitive and then uses a subsequent path segment such as __proto__.
Is Object.prototype pollution possible through normal data paths?
Not through ordinary data path segments. Reaching Object.prototype requires a non-data path segment, such as an object with a toString method that returns a different value on each call or a Proxy that accepts an assignment without storing it.
What versions remediate the issue?
Upgrade to traverse 0.3.10, 0.4.7, 0.5.3, or 0.6.12, as applicable to the release line in use.
What can be done if an upgrade cannot be applied immediately?
Do not pass untrusted paths to set(), particularly where those paths can traverse values that may be strings, numbers, or booleans. Restrict or validate path segments before calling set().