Tamagui
Monthly
Prototype pollution in Tamagui's updateConfig function allows authenticated remote attackers to inject arbitrary properties into the JavaScript Object prototype, affecting all versions through 2.3.0. The flaw in code/core/web/src/config.ts permitted passing '__proto__' as the key argument to updateConfig, causing Object.assign to merge attacker-controlled values directly onto Object.prototype. No public exploitation (KEV) is confirmed, but proof-of-concept exploit code exists per SSVC assessment; EPSS at 0.34% (26th percentile) reflects limited observed exploitation interest at time of analysis.
Prototype pollution in Tamagui's updateConfig function allows authenticated remote attackers to inject arbitrary properties into the JavaScript Object prototype, affecting all versions through 2.3.0. The flaw in code/core/web/src/config.ts permitted passing '__proto__' as the key argument to updateConfig, causing Object.assign to merge attacker-controlled values directly onto Object.prototype. No public exploitation (KEV) is confirmed, but proof-of-concept exploit code exists per SSVC assessment; EPSS at 0.34% (26th percentile) reflects limited observed exploitation interest at time of analysis.