{"id":"CVE-2019-10793","aliases":["GHSA-j9cf-pr2x-5273","SNYK-JS-DOTOBJECT-548905"],"url":"https://o3.security/vulnerability/CVE-2019-10793","summary":"Prototype Pollution in dot-object","details":"dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.","published":"2020-02-18T16:15:10.327Z","modified":"2026-07-08T06:00:40.293725552Z","cvss":{"score":6.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},"epss":{"score":0.01098,"percentile":0.62638,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"dot-object","fixedVersion":"2.1.3"}],"fix":{"url":"https://github.com/rhalff/dot-object/commit/f76cff5fe6d01d30ce110d8f454db2e5bd28a7de","label":"rhalff/dot-object@f76cff5"},"references":[{"type":"FIX","url":"https://github.com/rhalff/dot-object/commit/f76cff5fe6d01d30ce110d8f454db2e5bd28a7de"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-DOTOBJECT-548905"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:00:40.293725552Z"}}