{"action":"Upgrade dottie to 2.0.7 or later.","affected":[{"fixed":"2.0.7","introduced":"2.0.4"}],"component":"dottie","cve_ids":["CVE-2026-27837"],"ecosystem":"npm","epss":0.00362,"exploited":false,"fixed_versions":["2.0.7"],"ghsa_id":"GHSA-r5mx-6wc6-7h9w","id":"tcs_01M5KG82J4GNY9S9S64H8XK5HD","modified_at":"2026-02-26T22:11:18.547258Z","published_at":"2026-02-26T19:54:34Z","references":["https://osv.dev/vulnerability/GHSA-r5mx-6wc6-7h9w","https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w","https://nvd.nist.gov/vuln/detail/CVE-2026-27837","https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14","https://github.com/advisories/GHSA-4gxf-g5gf-22h4","https://github.com/mickhansen/dottie.js"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-r5mx-6wc6-7h9w","url":"https://osv.dev/vulnerability/GHSA-r5mx-6wc6-7h9w"}],"summary":"dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()"}