CVE-2026-27837: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27837 is a prototype pollution bypass vulnerability in the dottie npm package (dottie.js) for JavaScript, affecting versions 2.0.4 through 2.0.6. It represents an incomplete fix for the prior prototype pollution vulnerability CVE-2023-26132: the guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, leaving dottie.set() and dottie.transform() exploitable when __proto__ appears at any non-first position. The vulnerability was published on February 24–26, 2026, and is patched in version 2.0.7. The GitHub Advisory (GHSA-r5mx-6wc6-7h9w) rates it Moderate with a CVSS v3.1 score of 6.3, while Feedly's aggregated data assigns a score of 9.8 (Critical) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The flawed guard in dottie.set() and dottie.transform() only checked pieces[0] === '__proto__'; when a path such as 'a.__proto__.polluted' is processed, pieces[0] evaluates to 'a', bypassing the check entirely. During path traversal, current['__proto__'] = {} triggers the __proto__ setter, replacing the intermediate object's prototype, and the attacker-controlled value is then written onto this new prototype. Critically, this does not pollute the global Object.prototype — it injects properties into a specific object's prototype chain — but injected properties are invisible to hasOwnProperty() and Object.keys(), making them difficult to detect. A public PoC is included in the GitHub security advisory (Github Advisory, Patch Commit).

The primary risk is authorization bypass: an attacker who can control input passed to dottie.set() or dottie.transform() can inject properties such as isAdmin: true into objects used for access control decisions, which will be returned by property access (e.g., if (session.isAdmin)) but hidden from hasOwnProperty() and Object.keys() checks. This is particularly impactful in applications using Sequelize (which depends on dottie and has approximately 1.3 million weekly npm downloads), where user-supplied data may flow directly into these functions. Additionally, replacing an object's prototype strips all inherited methods, potentially causing TypeError exceptions and denial of service. Downstream IBM products including watsonx Orchestrate, QRadar Suite Software, Cloud Pak for Business Automation, and Business Automation Insights are also affected (Github Advisory, IBM Advisory).

A public proof-of-concept exploit is included in the GitHub security advisory and has been referenced on exploit aggregation platforms such as Sploitus. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.034% (Feedly data), indicating a low but non-negligible probability of near-term exploitation. The attack requires no authentication and no special privileges, though the GitHub advisory notes user interaction may be required in some scenarios (Github Advisory, Feedly).

1. Identify a vulnerable target: Find a Node.js application using dottie versions 2.0.4–2.0.6 (e.g., applications built on Sequelize, which depends on dottie). Check package.json or package-lock.json for the dottie version.
2. Locate user-controlled input paths: Identify application endpoints where user-supplied data is passed as a dot-separated path string to dottie.set() or as flat object keys to dottie.transform().
3. Craft a bypass payload: Construct a path with __proto__ at a non-first position, e.g., 'session.__proto__.isAdmin' for set(), or use a flat object key like 'user.__proto__.role': 'admin' for transform().
4. Submit the payload: Send the crafted input to the vulnerable endpoint (e.g., via an HTTP request body or query parameter that the application processes with dottie).
5. Trigger authorization bypass: The injected property (e.g., isAdmin: true) is now accessible via prototype chain on the target object. Any subsequent if (obj.session.isAdmin) check returns true, granting unauthorized access. Standard detection via hasOwnProperty() or Object.keys() will not reveal the injected property.

PoC (from advisory):

const dottie = require('dottie');
const obj = {};
dottie.set(obj, 'session.__proto__.isAdmin', true);
console.log(obj.session.isAdmin); // true
console.log(obj.session.hasOwnProperty('isAdmin')); // false

(Github Advisory)

• Logs: Application logs showing unexpected access control decisions (e.g., non-admin users granted admin privileges) without corresponding database or session changes; Node.js error logs containing TypeError exceptions related to missing inherited methods on objects processed by dottie.
• Network: HTTP requests to application endpoints containing dot-separated path strings with __proto__, constructor, or prototype segments in body parameters or query strings (e.g., session.__proto__.isAdmin=true).
• Application Behavior: Authorization checks returning true for properties that are not own properties of the object (detectable by auditing hasOwnProperty() vs. direct property access discrepancies); unexpected TypeError exceptions in code that calls inherited methods on objects processed by dottie.
• File System / Dependencies: Presence of dottie versions 2.0.4, 2.0.5, or 2.0.6 in node_modules/dottie/package.json or package-lock.json.

Upgrade dottie to version 2.0.7 or later, which fixes the bypass by checking all path segments (not just the first) against a blocklist of dangerous keys (__proto__, constructor, prototype) in both set() and transform(). If immediate patching is not possible, audit all application code paths where user-controlled input is passed to dottie.set() or dottie.transform() and sanitize inputs to reject any path segments matching __proto__, constructor, or prototype. IBM has released patches for affected products including watsonx Orchestrate, QRadar Suite Software, Cloud Pak for Business Automation, and Business Automation Insights (Patch Commit, Github Advisory, IBM Advisory).

The vulnerability was reported by researcher 76embiid21 and published via the GitHub Security Advisory program on February 24, 2026. Red Hat tracked it via Bugzilla (Bug 2442905) and IBM issued multiple security bulletins for affected enterprise products. The dottie.js repository was subsequently archived by its owner on April 5, 2026, marking it as read-only. No significant broader media coverage or notable social media discussion beyond standard CVE tracking feeds has been identified (Github Advisory, Red Hat Bugzilla).