PT-2026-42701 · Npm+2 · @Nevware21/Ts-Utils+1
CVE-2026-46681
·
Published
2026-05-21
·
Updated
2026-07-23
CVSS v4.0
7.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
Name of the Vulnerable Software and Affected Versions
@nevware21/ts-utils versions prior to 0.14.0
Description
The
copyProps() function in lib/src/object/copy.ts iterates over source object properties using a for...in loop without performing an Object.hasOwnProperty check. Additionally, it fails to filter dangerous keys such as proto, constructor, and prototype. This flaw allows an attacker to perform prototype pollution, which involves modifying the prototype chain of all objects in the application, potentially altering behavior or introducing vulnerabilities across the system.Recommendations
Update @nevware21/ts-utils to version 0.14.0.
Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Nevware21/Ts-Utils
Ts-Utils