External risk intelligence

dot-access Code Injection via Crafted Paths Enables OS Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-107700

This vulnerability exists in a Node.js library used for accessing object properties. While libraries like this are commonly used in web applications and APIs that may be internet-facing, the library itself is a backend development dependency rather than a standalone edge service or public-facing appliance, making exposure dependent on the specific implementation of the downstream application.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A code injection vulnerability has been identified in a Node.js library that could allow remote attackers to execute operating system commands by supplying malicious paths. This library is used for accessing object properties, and its potential exposure depends heavily on how it's implemented within downstream applications, particularly those that are internet-facing. The main concern is confirming relevance and exposure within our environment.

A code flaw lets attackers run commands on servers.
It could impact backend systems and data security.
Confirm library use and assess potential system exposure.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by sending a specially crafted path to the `get()` function in a vulnerable Node.js application. This path is used to construct JavaScript code, allowing an attacker to execute arbitrary commands on the server. The vulnerability can lead to the execution of operating system commands.

No authentication or special access needed.
Supplying a malicious path to the `get()` function.
Remote command execution on the server.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, remote attackers could execute arbitrary operating system commands by supplying specially crafted paths to the `get()` function within the dot-access library. This occurs because the provided path is concatenated directly into a JavaScript `Function` body, enabling the attacker to reach `constructor.constructor` to load the `child_process` module.

Operating system commands.
Crafted paths to `get()`.
Compromise of Node.js process.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the nature of the vulnerability in the `dot-access` Node.js library, application owners and platform teams are likely responsible for remediation. The first practical step is to identify all applications and services utilizing this library, determine if they are exposed externally or handle untrusted input, and confirm the business criticality of these assets. Once identified and prioritized, a remediation plan involving vendor coordination for updated library versions or code adjustments should be developed.

Application owners and platform teams.
Verify library usage and external exposure.
Plan updates or code remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is dot-access and how is it used?

dot-access is a lightweight Node.js utility library developers use to simplify reading and writing values within deep or complex JavaScript objects using string paths. It acts as a helper tool within backend applications, allowing software to easily navigate data structures that would otherwise require multiple nested checks.

What does code injection mean for CVE-2026-107700?

This vulnerability is a form of code injection (CWE-94), where the software improperly treats user-provided input as executable code. Because the library uses a dynamic function constructor, supplying a specifically formatted string allows an attacker to break out of the intended data navigation and run unauthorized operating system commands directly on the server hosting the application.

How can an attacker trigger this vulnerability?

An attacker triggers this by submitting a malicious path string to the affected get() function. The flaw requires that the application passes untrusted input directly into this library; if an application only uses hardcoded, trusted paths provided by developers, it will not trigger the vulnerability. It only succeeds when the library processes input originating from an external or uncontrolled source.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal indicates that while the library is a backend dependency and not a standalone internet-facing appliance, the risk is determined by how your specific application uses it. If your software allows external users to influence the path arguments passed to dot-access, the library acts as a bridge for remote code execution, regardless of whether the library itself is technically a backend component.

What are the first steps to address CVE-2026-107700?

Start by auditing your codebase to identify if and where dot-access is utilized. Focus your investigation on any entry points where user-supplied data is passed as a path to the get() function. Once you map these dependencies, prioritize testing or restricting input for internet-facing applications while you coordinate with your team to plan for library updates or code-level adjustments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.