Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@nevware21/ts-utils

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.2npmAmendedPublished

    @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

    CVE-2026-46681 · GHSA-x7j8-49r8-mr43

    Affected
    • npm @nevware21/ts-utils <= 0.13.0
    Fixed in
    0.14.0· Vendor fix available
    Issue
    The copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Details In copyProps() (copy.ts lines 186-191), the code iterates all enumerable properties including inherited ones and dangerous keys like proto. Any object with a proto key (e.g., from untrusted JSON input) will overwrite the target's prototype. PoC Suggested Fix Add objHasOwnProperty check and filter proto, constructor, prototype keys.

    Recommended action: Upgrade to 0.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →