Dottie.js provides nested object access through dot‑separated paths. A bug in a defensive guard added in a previous patch only inspects the first segment of such a path, allowing an attacker to insert "__proto__" in any other segment and cause prototype pollution. This changes shared prototypes and can alter the behavior of other objects that rely on them. The vulnerability is classified under CWE‑1321 (Prototype Pollution) and CWE‑915 (Implicit Type Conversion).

The issue affects the dottie.js library maintained by mickhansen. Versions 2.0.4 through 2.0.6 contain the incomplete fix and are vulnerable. Version 2.0.7 and later contain an updated fix that removes the flaw. Applications that embed these specific Node.js module versions, especially those that rely on user‑supplied dot‑path strings, are at risk.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low but non‑zero chance of exploitation. The vulnerability is not listed in CISA's KEV catalog, so no widespread known exploitation has yet been reported. The most likely attack vector is any code path that passes user‑supplied or untrusted dot‑separated paths to dottie.set() or dottie.transform(), enabling an attacker to manipulate prototypes that other code may later use.