Critical Code Injection Flaw in dot-access npm Package Allows Remote Command Execution

A critical code injection vulnerability has been identified in the dot-access npm package, allowing remote attackers to execute arbitrary operating system commands on affected systems. The flaw, tracked as CVE-2026-107700, impacts versions 0.0.3 through 1.0.0 of the library maintained by ntharim.

The vulnerability carries a CVSS score of 9.3, classified as Critical. It stems from improper handling of user-supplied input within the package’s core functionality. According to the National Vulnerability Database (NVD) record, the issue is categorized under CWE-94, indicating a code injection weakness. The flaw allows attackers to supply crafted paths to the get() function, which are then processed unsafely by the application.

Technical Context

The root cause of the vulnerability lies in how the dot-access package constructs function bodies. When an attacker supplies a crafted path to the get() method, this path is concatenated directly into a new Function body within the index.js file. This behavior creates an injection vector where the attacker can manipulate the code execution flow.

By carefully constructing the input path, an attacker can navigate the JavaScript object prototype chain to reach constructor.constructor. This specific access pattern allows the attacker to load the child_process module, a core Node.js module that provides the ability to spawn child processes. Once child_process is loaded, the attacker can execute arbitrary operating system commands within the context of the Node.js process. This effectively grants the attacker remote code execution (RCE) capabilities on the host system.

Who Is Affected

The vulnerability affects any Node.js application that includes the dot-access package in its dependency tree. Specifically, versions 0.0.3, 0.0.4, 0.0.5, and all subsequent releases up to and including version 1.0.0 are vulnerable. The package is maintained by the developer known as ntharim.

Applications using these versions are at risk if they expose the get() function to untrusted input. This includes web applications, APIs, or server-side scripts that accept user-generated data and pass it through the dot-access library for property access or traversal. Because the vulnerability allows for remote exploitation, any internet-facing service relying on affected versions is potentially exposed to remote attackers.

What should you do?

Security professionals should immediately audit their Node.js projects for the presence of the dot-access package. Use package managers such as npm or yarn to check installed versions. If version 0.0.3 through 1.0.0 is detected, it should be removed or replaced.

The source material does not indicate that a patched version of the package has been released. Therefore, there is no confirmed fix available within the current version history. Organizations should consider removing the dependency entirely if it is not critical to their application's functionality. Alternatively, developers may need to implement strict input validation and sanitization before passing data to any property access functions, although removing the vulnerable library is the most secure mitigation strategy given the severity of the flaw.