@tmlmobilidade/utils CVE-2026-45325
HIGH
GHSA-cmxg-94mg-jq94
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
2DescriptionNVD
Impact
Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().
Patches
A fix is available in versions 20260509.0340.15 and up.
AnalysisAI
Prototype pollution in the @tmlmobilidade/utils npm package allows remote unauthenticated attackers to inject properties into Object.prototype via the setValueAtPath() helper, leading to integrity compromise and partial availability impact in any downstream application that passes user-influenced paths into the function. The flaw is rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N) and is fixed in version 20260509.0340.15; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit your software bill of materials (SBOM) to identify all applications using @tmlmobilidade/utils; alert development and infrastructure teams of the HIGH severity vulnerability. Within 7 days: Upgrade @tmlmobilidade/utils to version 20260509.0340.15 in all affected applications; conduct comprehensive testing in staging environments before production deployment. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today