CVE-2023-26132

Name	CVE-2023-26132
Description	Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1040592

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-dottie (PTS)	bookworm	2.0.2-4+deb12u1	fixed
	trixie	2.0.6+~2.0.5-2	fixed
	forky, sid	2.0.7+~2.0.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
node-dottie	source	bullseye	2.0.2-1+deb11u1
node-dottie	source	bookworm	2.0.2-4+deb12u1
node-dottie	source	(unstable)	2.0.6+~2.0.5-1	1040592

https://security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763
https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68 (v2.0.4)