CVE-2026-107353
Description
A flaw was found in the traverse package. When an application processes untrusted property paths through the set() function, a remote attacker can trigger prototype pollution (a vulnerability where shared base object templates in JavaScript are altered). By supplying crafted path inputs crossing primitive values, an attacker can add or modify properties on built-in object prototypes, potentially altering application behavior or causing a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires a host application to accept unvalidated path structures from untrusted callers, limiting the exposure under standard deployment architectures. In typical Red Hat environments, services do not routinely expose raw object traversal paths directly to end users. Although modifying built-in primitive prototypes can disrupt expected application flow or lead to a denial of service, it does not directly enable arbitrary code execution or sensitive information leakage.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
