PT-2026-42651 · Npm · @Nevware21/Ts-Utils

Published 2026-05-21 · Updated 2026-05-21

OSV

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Summary

The copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys ( proto , constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.

Details

In copyProps() (copy.ts lines 186-191), the code iterates all enumerable properties including inherited ones and dangerous keys like proto . Any object with a proto key (e.g., from untrusted JSON input) will overwrite the target's prototype.

PoC

const malicious = JSON.parse('{" proto ": {"polluted": true}}');
objDeepCopy(malicious);
console.log({}.polluted); // true

Suggested Fix

Add objHasOwnProperty check and filter proto , constructor, prototype keys.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

GHSA-X7J8-49R8-MR43

Affected Products

@Nevware21/Ts-Utils

References · 3

• https://osv.dev/vulnerability/GHSA-x7j8-49r8-mr43 · Vendor Advisory
• https://github.com/nevware21/ts-utils/security/advisories/GHSA-x7j8-49r8-mr43 · Note
• https://github.com/nevware21/ts-utils · Note