CVE-2026-15538

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15538
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15538.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15538
Published
2026-07-13T06:00:11.115Z
Modified
2026-07-16T03:48:55.239122803Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
primefaces primereact API ObjectUtils.mutateFieldData prototype pollution
Details

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-1321",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15538.json"
}
References

Affected packages

Git / github.com/primefaces/primereact

Affected ranges

Type
GIT
Repo
https://github.com/primefaces/primereact
Events
Introduced
424af0b1f9a2dd9fa4d2f6f5b03ad8b6b62df621
Last affected
81294c100d8b02397f0133a623d98809a3e0e324
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "10.9.0"
        },
        {
            "last_affected": "10.9.0"
        },
        {
            "introduced": "10.9.1"
        },
        {
            "last_affected": "10.9.1"
        },
        {
            "introduced": "10.9.2"
        },
        {
            "last_affected": "10.9.2"
        },
        {
            "introduced": "10.9.3"
        },
        {
            "last_affected": "10.9.3"
        },
        {
            "introduced": "10.9.4"
        },
        {
            "last_affected": "10.9.4"
        },
        {
            "introduced": "10.9.5"
        },
        {
            "last_affected": "10.9.5"
        },
        {
            "introduced": "10.9.6"
        },
        {
            "last_affected": "10.9.6"
        },
        {
            "introduced": "10.9.7"
        },
        {
            "last_affected": "10.9.7"
        },
        {
            "introduced": "10.9.8"
        },
        {
            "last_affected": "10.9.8"
        }
    ]
}

Affected versions

10.*
10.9.0
10.9.1
10.9.2
10.9.3
10.9.4
10.9.5
10.9.6
10.9.7
10.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15538.json"