vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-46681

@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

HIGH
7.2
CVSS Score
Published: July 21, 2026 at 02:02 PM UTC
Updated: October 24, 2026 at 08:10 PM UTC
1 product affected across 1 vendorTs Utils

Using ts-utils by nevware21?

Get instant alerts when new vulnerabilities affect ts-utils - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.2
Exploit prediction
EPSS 0.4%
SSVC
PoC

Description

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Version 0.14.0 patches the issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ts Utils· NEVWARE21
90%
v < 0.14.0
Affected range stops below 0.14.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

x_refsource_CONFIRM
Source: cverecord
https://github.com/nevware21/ts-utils/security/advisories/GHSA-x7j8-49r8-mr43
x_refsource_MISC
Source: cverecord
https://github.com/nevware21/ts-utils/commit/5e887f4e2fbee7160c8f501634c45e6a229e83bb

SSVC — Action Prioritization

SSVCPoCAutomatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.2HIGHGitHub_M
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-1321

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card