SEPTEMBER 7, 2026
Live Feed
Back to database
Case File

CVE-2026-46681

HIGH · CVSS 7.2 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-21 · Last synced 2026-08-20

CyberRota Analysis

AI-Generated

The _copyProps function in the @nevware21/ts-utils library prior to version 0.14.0 is vulnerable due to its use of for...in to iterate over object properties without proper checks, allowing for prototype pollution through dangerous keys like __proto__. This can lead to unexpected behavior and potential security risks across the application. Developers using this library should prioritize upgrading to version 0.14.0 to mitigate these vulnerabilities.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-46681
Severity
HIGH
CVSS
7.2
EPSS
0.28%
Java

Original NVD Description

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Version 0.14.0 patches the issue.