GHSA-x7j8-49r8-mr43
Suggest an improvement- Source
- https://github.com/advisories/GHSA-x7j8-49r8-mr43
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-x7j8-49r8-mr43/GHSA-x7j8-49r8-mr43.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-x7j8-49r8-mr43
- Aliases
- Published
- 2026-05-21T21:41:36Z
- Modified
- 2026-09-10T03:51:07Z
- Severity
-
- 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
- Details
-
Summary
The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.
Details
In _copyProps() (copy.ts lines 186-191), the code iterates all enumerable properties including inherited ones and dangerous keys like proto. Any object with a proto key (e.g., from untrusted JSON input) will overwrite the target's prototype.
PoC
const malicious = JSON.parse('{"__proto__": {"polluted": true}}'); objDeepCopy(malicious); console.log({}.polluted); // trueSuggested Fix
Add objHasOwnProperty check and filter proto, constructor, prototype keys.
- Database specific
{ "cwe_ids": [ "CWE-1321" ], "github_reviewed": true, "github_reviewed_at": "2026-05-21T21:41:36Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
npm / @nevware21/ts-utils
Package
- Name
- @nevware21/ts-utils
- View open source insights on deps.dev
- Purl
- pkg:npm/%40nevware21/ts-utils