CVE-2020-7639Medium· 5.3▾ Sunliteivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.1%
eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.
dot < 1.0.3Upgrade past the affected range:
dot 1.0.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118243Medium· 5.3Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
CVE-2026-118247Medium· 6.9Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
CVE-2026-118248Medium· 6.9Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
CVE-2026-118249High· 7.2Highcharts: series column construction writes to Object.prototype
CVE-2026-118250High· 7.2Highcharts: dotted series.keys paths write to Object.prototype
CVE-2026-116674Medium· 6.5systeminformation has prototype pollution in `networkStats()` via the interface name