CyberRota Analysis
AI-GeneratedThe Gestor de Oferta web application is vulnerable to prototype pollution due to inadequate validation of path segments in the setValueAtPath() function, potentially allowing attackers to manipulate object prototypes and execute arbitrary code. This high-severity vulnerability, with a CVSS score of 8.2, poses significant risks to the integrity and security of affected systems. Organizations using versions prior to 20260509.0340.15 should prioritize updating to the patched version to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.