CVE-2026-15187

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15187

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15187.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15187

Published

2026-07-09T14:30:09.080Z

Modified

2026-07-11T04:03:17.793864423Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

enquirer Public Package API Enquirer.set prototype pollution

Details

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-1321",
        "CWE-94"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.4.1"
                },
                {
                    "last_affected": "2.4.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15187.json"
}

References

Affected packages

Git / github.com/enquirer/enquirer

Affected ranges

Type

GIT

Repo

https://github.com/enquirer/enquirer

Events

Introduced

04a80c7060e58e2ab1d8abdaff86ee8c2da7060a

Last affected

04a80c7060e58e2ab1d8abdaff86ee8c2da7060a

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.4.0"
        },
        {
            "last_affected": "2.4.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*

2.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15187.json"