CVE-2023-45827 - CVE House
Back to Database
Status published High CVE-2023-45827

Prototype Pollution vulnerability in @clickbar/dot-diver

Vulnerability Description

Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-45827

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

dot-diver
Vulnerable Versions:
< 1.0.2

Timeline

Official Publish: November 6th, 2023
Last Modified: September 4th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-1321

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.