CVE-2026-15187

Name of the Vulnerable Software and Affected Versions enquirer versions prior to 2.4.2

Description A flaw in the Public Package API component allows remote attackers to perform prototype pollution. By manipulating the question.name argument within the Enquirer.set() function, an attacker can cause improperly controlled modification of object prototype attributes. Prototype pollution is a technique where an attacker modifies the base prototype of an object, potentially affecting all objects created from that prototype.

Recommendations Update to version 2.4.2 or later. As a temporary mitigation, restrict or validate the input passed to the question.name argument in the Enquirer.set() function.