Medium, CVSS 4.8npmAmendedPublished
@hey-api/openapi-ts's buildClientParams template: prototype chain substitution via unknown $ ___proto__ key
CVE-2026-48819 · GHSA-hhx9-57xq-r5rw
- Affected
- npm @hey-api/openapi-ts < 0.97.3
- Fixed in
- 0.97.3· Vendor fix available
- Issue
- dist/clients/core/params.ts in @hey-api/openapi-ts ships a runtime template that is copied verbatim into every generated SDK as params.gen.ts. When a caller passes an object argument containing an unknown key starting with a slot prefix ($body, $headers, $path, $query), the function strips the prefix and writes the remainder directly to that slot without validation. The key "$queryproto" causes the returned params.query object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least 0.97.2. Details The vulnerable branch in dist/clients/core/params.ts: This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes "$queryproto" as an extra key alongside a legitimate field, the key is not in the field map, key.startsWith("$query") is true, and key.slice(7) produces "proto". The bracket-write params["query"]["proto"] = value…
Recommended action: Upgrade to 0.97.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.