high7.5
CVE-2023-26106
dot-lens vulnerable to Prototype Pollution
Impact
All versions of the package dot-lens are vulnerable to Prototype Pollution via the `set()` function in `index.js` file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | dot-lens | <= 1.2.3 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dot-Lens Project | Dot-Lens | through 1.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/jb55/dot-lens/blob/465ef2088e4065b7be1c4372eedd2215c3820bc4/index.js%23L70
- https://security.snyk.io/vuln/SNYK-JS-DOTLENS-3227646
- https://github.com/advisories/GHSA-rmhg-2cvv-q7vx
- https://nvd.nist.gov/vuln/detail/CVE-2023-26106
- https://github.com/jb55/dot-lens/blob/465ef2088e4065b7be1c4372eedd2215c3820bc4/index.js#23L70