PT-2026-57643 · Primefaces · Primereact

Dremig · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-15538

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions primefaces primereact versions prior to 10.9.9

Description A weakness in the API component allows remote attackers to cause improperly controlled modification of object prototype attributes. This occurs through the manipulation of the Field argument within the ObjectUtils.mutateFieldData() function. This issue specifically affects products that are no longer supported by the maintainer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-94

Related Identifiers

CVE-2026-15538

Affected Products

Primereact

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-15538 · Security Note
• https://github.com/primefaces/primereact/issues/8553 · Note
• https://github.com/Mantle-UI/mantle-ui/issues/50 · Note
• https://vuldb.com/cve/CVE-2026-15538 · Note
• https://vuldb.com/submit/855024 · Note
• https://vuldb.com/vuln/377888 · Note
• https://twitter.com/CVEnew/status/2076612847589818668 · Twitter Post
• https://vuldb.com/vuln/377888/cti · Note
• https://twitter.com/infoflowcloud/status/2076614094296080656 · Twitter Post
• https://github.com/primefaces/primereact · Note