What is the CVSS score of CVE-2026-45325?

CVE-2026-45325 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of @tmlmobilidade/utils are affected by CVE-2026-45325?

A prototype pollution vulnerability in the @tmlmobilidade/utils npm package enables attackers to corrupt application data and degrade performance without requiring authentication, creating material…. A patch is available.

How to fix or mitigate CVE-2026-45325?

Within 24 hours: Audit your software bill of materials (SBOM) to identify all applications using @tmlmobilidade/utils; alert development and infrastructure teams of the HIGH severity vulnerability. Within 7 days: Upgrade @tmlmobilidade/utils to version 20260509.0340.15 in all affected applications; conduct comprehensive testing in staging environments before production deployment. Within 30 days: Verify complete production deployment of patched version; implement monitoring for exploitation indicators (unexpected object property modifications in application logs).

@tmlmobilidade/utils CVE-2026-45325

HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-05-18 https://github.com/tmlmobilidade/go

GHSA-cmxg-94mg-jq94

Information Disclosure Prototype Pollution

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

May 18, 2026 - 18:01 vuln.today

Analysis Generated

May 18, 2026 - 18:01 vuln.today

DescriptionGitHub Advisory

Impact

Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().

Patches

A fix is available in versions 20260509.0340.15 and up.

AnalysisAI

Prototype pollution in the @tmlmobilidade/utils npm package allows remote unauthenticated attackers to inject properties into Object.prototype via the setValueAtPath() helper, leading to integrity compromise and partial availability impact in any downstream application that passes user-influenced paths into the function. The flaw is rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N) and is fixed in version 20260509.0340.15; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerable code lives in packages/utils/src/generic/value-at-path.ts and implements a generic dot-path setter that recursively walks an object using user-supplied key segments. Because the original implementation did not block the reserved JavaScript keys __proto__, constructor, or prototype, an attacker who controls the path argument could traverse into Object.prototype and assign arbitrary properties - the textbook CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) pattern. The fix introduces an UNSAFE_KEYS Set ({'__proto__', 'constructor', 'prototype'}) and throws when any segment matches, which is the standard mitigation for prototype-walking sinks in JavaScript/TypeScript utility libraries. The affected package identifier is pkg:npm/@tmlmobilidade_utils, distributed via npm and consumed by the tmlmobilidade/go monorepo's TypeScript services.

RemediationAI

Vendor-released patch: upgrade @tmlmobilidade/utils to 20260509.0340.15 or later, which adds an explicit UNSAFE_KEYS denylist for __proto__, constructor, and prototype inside setValueAtPath() (commit https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7; advisory https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94). If immediate upgrade is not possible, wrap calls to setValueAtPath() in a caller-side validator that rejects path segments equal to __proto__, constructor, or prototype, or refactor callers to use Map or Object.create(null) targets so prototype writes have no effect - the trade-off is added boilerplate and the need to audit every call site. As a broader compensating control, freeze Object.prototype at process startup via Object.freeze(Object.prototype), but be aware this can break libraries that legitimately extend prototypes and should be tested in staging first.