[Pkg-javascript-devel] Bug#1150332: node-traverse: CVE-2026-107353

[Moritz Mühlenhoff]

Source: node-traverse
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for node-traverse.

CVE-2026-107353[0]:
| traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6,
| 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype
| pollution through set(). When the path passed to set() crosses a
| primitive value, the next path segment is resolved on that
| primitive's built-in prototype, so an application that passes an
| untrusted path to set() lets an attacker add or overwrite properties
| of String.prototype, Number.prototype, or Boolean.prototype using
| plain JSON data, for example traverse({ name: 'bob' }).set(['name',
| '__proto__', 'polluted'], 'yes'). Object.prototype was reachable
| only with a non-data path segment, such as an object whose toString
| returns a different value on each call, or through a Proxy that
| accepts an assignment without storing it. This is fixed in 0.3.10,
| 0.4.7, 0.5.3, and 0.6.12.

https://github.com/ljharb/js-traverse/security/advisories/GHSA-rj28-8w7x-jmqc
https://github.com/ljharb/js-traverse/commit/81ccab43e379cf42eb2a5f689630f7f79b3d71b8 (v0.6.12)
https://github.com/ljharb/js-traverse/commit/37a9ebd103d2a259c824c29cdcc3f0dfe1acffce (v0.6.12)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107353
    https://www.cve.org/CVERecord?id=CVE-2026-107353

Please adjust the affected versions in the BTS as needed.