CVE-2026-107700 in dot-access
Summary
by MITRE • 10/08/2026
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The dot-access library versions 0.0.3 through 1.0.0 are susceptible to a critical code injection vulnerability that stems from unsafe handling of user-supplied input within its core path resolution logic. This flaw allows remote attackers to execute arbitrary JavaScript code by providing specifically crafted paths to the get() method. The root cause lies in how the library processes these inputs, as it directly concatenates the provided path string into a new Function body without adequate sanitization or validation of special characters and reserved keywords.
From a technical perspective, this vulnerability is classified under CWE-94 Improper Control of Generation of Code (Code Injection). The mechanism exploits the dynamic nature of JavaScript's Function constructor, which evaluates strings as executable code. By injecting malicious payloads into the path argument, an attacker can bypass intended access controls and reach sensitive internal properties such as constructor.constructor. This specific technique is a well-known pattern for escaping sandboxed environments or restricted contexts in Node.js applications, allowing the execution of arbitrary commands outside the normal scope of the application logic.
The operational impact of this vulnerability is severe, potentially leading to full remote code execution on the host system running the vulnerable library. Once an attacker successfully injects and executes JavaScript via the Function constructor, they can leverage standard Node.js modules like child_process to spawn operating system processes. This means that if a web application or API relies on dot-access for object property access and accepts user-controlled input in its path parameters without proper validation, it becomes a direct vector for server compromise. Attackers could exfiltrate sensitive data, modify files, install malware, or use the compromised node as part of a botnet.
This type of attack aligns with several techniques documented in the MITRE ATT&CK framework, particularly those related to command and script interpretation within application layers. The exploitation path demonstrates how improper input validation can lead to privilege escalation at the code level, effectively granting an unauthenticated user administrative control over the underlying operating system processes associated with the Node.js runtime environment.
To mitigate this vulnerability, organizations using dot-access should immediately upgrade to a patched version that addresses these security flaws or replace the library with a more secure alternative for object property access. If upgrading is not feasible in the short term, developers must implement strict input validation on any data passed to the get() method. This includes ensuring that inputs are strictly alphanumeric and do not contain characters such as dots, brackets, or quotes that could be used to break out of expected path structures. Additionally, employing a Content Security Policy (CSP) with nonces can help mitigate some forms of code injection by restricting where scripts can execute from, although this is primarily effective against cross-site scripting rather than server-side Node.js execution flaws. Regular security audits and the use of static analysis tools that detect dynamic function construction patterns are also recommended to prevent similar issues in future development cycles.