EUVD-2026-43294
GHSA-vg36-rrrg-4wqv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requires low-privilege auth (PR:L); prototype pollution yields limited C/I impact with no availability consequence and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Prototype pollution in PrimeReact (all versions through 10.9.8) allows authenticated remote attackers to improperly modify JavaScript object prototype attributes via the ObjectUtils.mutateFieldData API function by crafting malicious Field argument values. Affected deployments face limited confidentiality and integrity exposure at the vulnerable system level. No patch has been issued - the maintainer has not responded to responsible disclosure, and the affected version range is officially end-of-life. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
PrimeReact is a React UI component library by PrimeFaces, providing rich client-side UI components for web applications. The vulnerability resides in ObjectUtils.mutateFieldData within the library's API layer, responsible for mutating field data on component state objects. CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - Prototype Pollution) describes a class of JavaScript-specific vulnerabilities where attacker-controlled keys such as __proto__, constructor, or prototype are not sanitized before being used to set or merge object properties, allowing modification of the base Object prototype shared across the application runtime. Once the prototype is polluted, downstream code that inherits from Object.prototype may exhibit unintended behavior - potentially leading to property overrides that cause information disclosure, authorization bypass, or denial of service depending on how inherited properties are consumed. The CPE cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:* confirms the entire primereact package family by the primefaces vendor is affected through version 10.9.8.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the responsible disclosure report, and the affected product line is end-of-life. The primary remediation is migration away from PrimeReact versions through 10.9.8 to an actively maintained alternative React UI component library, as continued use of EOL software carries compounding risk beyond this specific CVE. As a compensating control, organizations should implement server-side input validation that rejects or strips keys matching known prototype pollution patterns (__proto__, constructor, prototype) before they reach the ObjectUtils.mutateFieldData function; this reduces exploitation surface but requires custom middleware and may affect legitimate field naming. Additionally, applying a JavaScript freeze on Object.prototype at application startup (Object.freeze(Object.prototype)) can prevent prototype modification at runtime, though this may break third-party libraries that rely on prototype extension. Restrict API endpoint exposure to authenticated, trusted users only - since PR:L is required, enforcing strict role-based access controls around components invoking this API function limits the attacker population. Reference: https://github.com/primefaces/primereact/issues/8553.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today