CVE-2026-107700: dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run operating system commands in the Node.js process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using npm/dot-access versions 0.0.3 through 1.0.0 are affected when attacker-controlled input can be supplied as the path argument to get(). The vulnerability can be exploited remotely without authentication or user interaction under those conditions.
What level of access can an attacker obtain?
A crafted get() path can execute JavaScript in the Node.js process. The described technique can load child_process and execute operating-system commands with the permissions of that process.
How can I identify potentially vulnerable code paths?
Review dependencies for dot-access versions 0.0.3 through 1.0.0 and locate calls to get(). Prioritize calls where the path argument is derived from HTTP requests, API parameters, form input, or other untrusted sources.
What can be done if updating is not immediately possible?
Do not pass untrusted values to get() as path arguments. Restrict path values to a defined allowlist of expected property names or otherwise validate them before calling get().