CVE-2026-107700: dot-access Path Manipulation Triggers Critical OS Command Execution on Node.js

A widely used Node.js library contains a severe security flaw that allows remote attackers to execute arbitrary code on servers. The vulnerability, tracked as CVE-2026-107700, affects the dot-access package maintained by ntharim. According to the National Vulnerability Database, the issue exists in versions 0.0.3 through 1.0.0. The flaw enables an attacker to inject and run JavaScript code by supplying specifically crafted path arguments to the library’s get() function.

In plain English

The dot-access package is designed to help developers retrieve data from nested objects using dot notation. However, the way it processes these paths is unsafe. When a user provides a path to the get() function, the code concatenates that input directly into a new Function body within index.js. This means any text supplied as a path is treated as executable code. An attacker can construct a path that breaks out of the intended data retrieval and instead loads the child_process module. This allows them to run operating system commands on the server hosting the Node.js application.

The background

The vulnerability is classified under CWE-94, which refers to code injection flaws. The National Vulnerability Database assigns it a CVSS score of 9.3, categorizing it as Critical. This high severity rating reflects the ease with which an attacker can exploit the flaw to gain control over the server environment. The issue stems from improper input validation, where the library fails to sanitize user-supplied paths before executing them. This allows the attacker to reach constructor.constructor, a technique often used to bypass security restrictions in JavaScript environments.

What changes now

Organizations using Node.js should immediately audit their dependencies for the dot-access package. Any application running versions 0.0.3 through 1.0.0 is exposed to remote code execution attacks. Since no patch or update has been confirmed yet, the primary mitigation is to remove or replace the vulnerable library. Security teams should monitor for vendor announcements regarding a fix. Until a secure version is available, restricting access to endpoints that utilize this library may reduce the attack surface.

What to do and how to stay safe: dot-access

• Inventory your Node.js projects to identify if dot-access versions 0.0.3 through 1.0.0 are installed.
• Monitor official npm channels or vendor communications for a patched version of the library.
• Implement strict input validation on any API endpoints that accept user-supplied paths or identifiers.
• Review server logs for unusual child_process activity or unexpected command executions.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of dot-access are affected by CVE-2026-107700?

Versions 0.0.3 through 1.0.0 of the dot-access npm package are affected.

What is the severity of this vulnerability?

The National Vulnerability Database rates it as Critical with a CVSS score of 9.3.

Can attackers run operating system commands through this flaw?

Yes, by supplying crafted paths to the get() function, attackers can load child_process and execute OS commands.