CVE-2026-46681: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in nevware21 ts-utils
@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Version 0.14.0 patches the issue.
AI Analysis
Technical Summary
The vulnerability in nevware21 ts-utils (before 0.14.0) involves the _copyProps function using a for...in loop without an Object.hasOwnProperty check and lacking filtering of dangerous keys such as __proto__, constructor, and prototype. This improper handling enables prototype pollution, where an attacker can manipulate the prototype chain of all objects, potentially leading to widespread application impact. Version 0.14.0 addresses this issue by correcting the property iteration and filtering behavior.
Potential Impact
An attacker exploiting this vulnerability can perform prototype pollution, which may lead to arbitrary code execution, denial of service, or other security issues depending on how the polluted prototype is used within the application. The CVSS 4.0 score of 7.2 (high severity) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade to nevware21 ts-utils version 0.14.0 or later, where the vulnerability is patched. No other mitigation is indicated or required as the fix is available in the updated version.
CVE-2026-46681: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in nevware21 ts-utils
Description
@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Version 0.14.0 patches the issue.
CVSS v4.0
Score 7.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in nevware21 ts-utils (before 0.14.0) involves the _copyProps function using a for...in loop without an Object.hasOwnProperty check and lacking filtering of dangerous keys such as __proto__, constructor, and prototype. This improper handling enables prototype pollution, where an attacker can manipulate the prototype chain of all objects, potentially leading to widespread application impact. Version 0.14.0 addresses this issue by correcting the property iteration and filtering behavior.
Potential Impact
An attacker exploiting this vulnerability can perform prototype pollution, which may lead to arbitrary code execution, denial of service, or other security issues depending on how the polluted prototype is used within the application. The CVSS 4.0 score of 7.2 (high severity) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade to nevware21 ts-utils version 0.14.0 or later, where the vulnerability is patched. No other mitigation is indicated or required as the fix is available in the updated version.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-15T21:46:51.547Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5f856d2a4a8d5989472596
Added to database: 07/21/2026, 14:42:53 UTC
Last enriched: 07/21/2026, 14:57:38 UTC
Last updated: 07/21/2026, 21:16:09 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.