CVE-2023-45827

Published: Nov 6, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.

Affected (1)

Products: Clickbar: Dot Diver

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Clickbar Dot Diver	Before 1.0.2

Related CWEs

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (4)

https://github.com/clickbar/dot-diver/commit/98daf567390d816fd378ec998eefe2e97f293d5a

Source: security-advisories@github.com

Patch

https://github.com/clickbar/dot-diver/security/advisories/GHSA-9w5f-mw3p-pj47

Source: security-advisories@github.com

Vendor Advisory

https://github.com/clickbar/dot-diver/commit/98daf567390d816fd378ec998eefe2e97f293d5a

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/clickbar/dot-diver/security/advisories/GHSA-9w5f-mw3p-pj47

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.