CVE-2026-107700

Name of the Vulnerable Software and Affected Versions dot-access versions 0.0.3 through 1.0.0

Description A code injection flaw exists where the get() function concatenates user-supplied paths into a new Function body within index.js. This allows remote attackers to access constructor.constructor to load the child process module and execute arbitrary operating system commands within the Node.js process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the get() function when handling untrusted input.