CVE-2026-107700

{
  "etk_id": "ETK-2026-1006",
  "cve_id": "CVE-2026-107700",
  "display_id": "CVE-2026-107700",
  "ghsa_id": "GHSA-rhfh-63ph-3pch",
  "euvd_id": "EUVD-2026-95146",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Code injection in dot-access path resolution",
  "summary": "dot-access versions 0.0.3 through 1.0.0 can execute attacker-controlled JavaScript when an application passes untrusted path input to get(). An attacker may thereby run commands with the permissions of the affected Node.js process if they can influence that path value.",
  "mitigation": "Do not pass user-controlled paths to get(); enforce a strict allowlist of expected property paths before calling it. No fixed version is recorded, so replace or locally remediate the affected dependency where untrusted paths cannot be excluded.",
  "vendor": "ntharim",
  "product": "dot-access",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.0.3, <= 1.0.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [],
      "package_name": "dot-access",
      "purl": "pkg:npm/dot-access"
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.005,
  "epss_percentile": 0.4191,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 13.2909194,
  "t0_at": "2026-10-08T18:36:35.684000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-08T20:39:28.005318+00:00",
      "days": 0.08532779303240741,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T18:36:35.684000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T18:36:35.684000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T18:36:35.684000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107700"
    }
  }
}