@tmlmobilidade/utils EUVD-2026-44971

Exploitation requires that a consuming application reach the @tmlmobilidade/utils setValueAtPath() function with attacker-controlled path segments (the keys array), and that the application later read a property whose name collides with the polluted key on a plain Object - a classic prototype-pollution gadget chain. Limiting factors: callers that pass only hardcoded or strictly validated paths are not exploitable; the impact is integrity-focused (C:N) so direct data disclosure is not in scope; and real-world severity depends on whether a sensitive downstream read exists (auth flags, template lookups, child_process options). No authentication or user interaction is required at the library level (PR:N/UI:N), but the network-reachability of the sink is application-specific.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) implies remote, unauthenticated, low-complexity abuse with high integrity impact and low availability impact - but this rating assumes the setValueAtPath() sink is reachable from an untrusted network input, which depends on how each consumer wires the utility. Prototype pollution itself is rarely a direct RCE; its real-world impact is gadget-dependent (downstream code paths that read polluted properties), so actual exploitability varies by consumer application. No EPSS score, KEV listing, or POC was provided in the source data, so the only confirmed signal is the vendor advisory (GHSA-cmxg-94mg-jq94) and the upstream patch commit. Priority should be elevated for any service that forwards HTTP-supplied JSON keys/paths into this function, and lower where the helper is only used with hardcoded paths.

An attacker submits a JSON payload to an HTTP endpoint of a downstream service that copies user-supplied keys into a dot-path passed to setValueAtPath(), for example a settings update API that accepts {"path": "__proto__.isAdmin", "value": true}. The unsafe segment walks into Object.prototype and assigns isAdmin=true globally, after which any subsequent authorization check that reads obj.isAdmin on a plain object inherits the polluted value, enabling privilege escalation or logic bypass. No public POC has been published at the time of analysis.