{"id":"CVE-2026-107353","revision":"d4fc63a906f44f7fb878198565ac76f1","records":[{"revision":"d4fc63a906f44f7fb878198565ac76f1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107353","aliases":[],"title":"traverse: set() can write to built-in prototypes via an untrusted path","description":"traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.","state":0,"publishedAt":"2026-10-07T19:35:15.351+00:00","modifiedAt":"2026-10-07T20:37:09.233+00:00","affected":[{"ecosystem":"https://www.npmjs.com","name":"traverse","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ljharb\",\n                    \"product\": \"traverse\",\n                    \"collectionURL\": \"https://www.npmjs.com\",\n                    \"packageName\": \"traverse\",\n                    \"repo\": \"https://github.com/ljharb/js-traverse\",\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"set\"\n                        }\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.3.6\",\n                            \"lessThan\": \"0.3.10\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.4.0\",\n                            \"lessThan\": \"0.4.7\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.5.0\",\n                            \"lessThan\": \"0.5.3\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.6.0\",\n                            \"lessThan\": \"0.6.12\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/ljharb/js-traverse/security/advisories/GHSA-rj28-8w7x-jmqc","https://github.com/ljharb/js-traverse/commit/81ccab43e379cf42eb2a5f689630f7f79b3d71b8","https://github.com/ljharb/js-traverse/commit/37a9ebd103d2a259c824c29cdcc3f0dfe1acffce"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107353","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107353","identifiers":["CVE-2026-107353"]},"retained":false,"historicalAffected":[]}],"coverage":[]}