Prototype pollution in nevware21/ts-utils objDeepCopy/objCopyProps (CVE-2026-46681)

The `_copyProps` function in `@nevware21/ts-utils` iterates object properties using `for...in` without an `Object.hasOwnProperty` check and does not filter dangerous keys such as `__proto__`, `constructor`, and `prototype`. An attacker who can supply attacker-controlled input reaching `objDeepCopy` can overwrite the prototype of all objects in the application, potentially enabling privilege escalation or remote code execution depending on the runtime context. Affected versions: - <= 0.13.0 We recommend updating to: 0.14.0. CVSS 7.2 · our assessment: this_week Reference: https://github.com/nevware21/ts-utils/security/advisories/GHSA-x7j8-49r8-mr43 Details: https://vuln.today/cve/CVE-2026-46681