The vulnerability CVE-2026-15598 affects antv layout version 2.0.0 specifically in the setNestedValue function within lib/util/object.js. Improper handling of the argument path allows an attacker to modify object prototype attributes improperly. This can be exploited remotely without user interaction and requires low attack complexity and privileges. The vulnerability was reported early to the project, but no response or fix has been issued. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, and limited impact on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability to manipulate object prototype attributes, which may lead to unexpected behavior or security issues in applications using the affected library. The impact on confidentiality, integrity, and availability is limited but present. There are no known exploits in the wild at this time.

No official fix or patch is currently available for this vulnerability. Users of antv layout 2.0.0 should monitor the vendor's communications for updates or patches. Until a fix is released, consider applying additional input validation or sandboxing measures to limit the impact of prototype pollution. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.