CVE-2019-10793: Prototype Pollution in dot-object
Summary
CVE-2019-10793: Prototype Pollution in dot-object. Affects dot-object versions < 2.1.3. Fixed in 2.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dot-object package is an npm package that provides a set of utility functions for manipulating JavaScript objects using dot notation. It allows users to easily set, get, and delete properties of an object using dot notation paths. However, versions of dot-object before 2.1.3 are vulnerable to Prototype Pollution. This vulnerability allows an attacker to modify or add properties to the Object.prototype using a proto payload.
Vulnerability Detail
The vulnerability in dot-object arises from the set function, which can be tricked into adding or modifying properties of Object.prototype. By providing a proto payload, an attacker can pollute the prototype chain of objects, leading to potential security issues such as arbitrary code execution, privilege escalation, or denial of service attacks. This vulnerability has a CVSSv3 score of 6.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.1.5 as of 23 Oct 2026
npm install dot-object@2.1.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.3
This is the first release that contains the fix.
npm install dot-object@2.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of dot-object to mitigate the risk of exploitation.
Conclusion
In conclusion, dot-object versions before 2.1.3 are vulnerable to Prototype Pollution. This vulnerability allows an attacker to modify or add properties to the Object.prototype using a proto payload. To mitigate the risk, it is recommended to upgrade to dot-object version 2.1.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dot-object →
FAQ
dot-object is an npm package that provides utility functions for manipulating JavaScript objects using dot notation paths.
Prototype Pollution is a vulnerability that allows an attacker to modify or add properties to the prototype of an object, leading to potential security issues.
This vulnerability could potentially allow an attacker to execute arbitrary code, escalate privileges, or perform denial of service attacks.
To fix this vulnerability, it is recommended to upgrade to dot-object version 2.1.3 or later.
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of dot-object.
