CVE-2023-26132

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-261339.8All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.CVE-2023-261349.8Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo CVE-2023-261359.8All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.CVE-2023-261369.8Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using Cooki CVE-2023-261376.1All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build head CVE-2023-261384.3All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers CVE-2023-261397.5Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() func CVE-2023-26145.4Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-261406.1Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard obje CVE-2023-261414.9Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js CVE-2023-261426.1All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header CVE-2023-261439.1Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not s