CVE-2026-48819

Name of the Vulnerable Software and Affected Versions @hey-api/openapi-ts versions prior to 0.97.3

Description An issue exists in the dist/clients/core/params.ts file, which is used as a runtime template in generated SDKs. The buildClientParams() function fails to validate unknown keys that start with specific slot prefixes, such as $body , $headers , $path , and $query . An attacker can provide a key like $query proto to trigger a prototype pollution attack, where the prototype chain of the params.query object is substituted with attacker-controlled data via Object.setPrototypeOf(). This can lead to the exposure of inherited keys during for..in iteration or affect downstream logic that relies on these objects for authorization or routing decisions.

Recommendations Update @hey-api/openapi-ts to version 0.97.3 or later.