The vulnerability CVE-2026-45325 affects the tmlmobilidade go package used in the Gestor de Oferta web application. It is a prototype pollution issue classified under CWE-1321, occurring in the setValueAtPath() function within packages/utils/src/generic/value-at-path.ts. Unsafe path segments are not properly blocked, enabling attackers to modify object prototype attributes improperly. This can lead to integrity impacts without direct confidentiality loss but with potential denial of service or other integrity-related consequences. The vulnerability is resolved in version 20260509.0340.15.

The vulnerability allows an attacker to perform prototype pollution, which can lead to modification of object prototype attributes. According to the CVSS vector, the attack can be performed remotely without privileges or user interaction, impacting integrity (high) and availability (low), but not confidentiality. This can cause unexpected behavior or denial of service in applications relying on the affected package.

A fix is available in version 20260509.0340.15 of the tmlmobilidade go package. Users should upgrade to this version or later to remediate the vulnerability. No vendor advisory indicating alternative mitigations or no-action is provided, so upgrading is the recommended course of action.