CyberRota Analysis
AI-GeneratedThe Hey API ecosystem prior to version 0.97.3 is vulnerable due to improper handling of dynamic keys in generated SDKs, which allows attackers to manipulate the prototype of the query parameters. This could lead to the exposure of inherited properties, potentially enabling unauthorized access to sensitive data or execution of arbitrary code. Organizations using affected versions should prioritize upgrading to 0.97.3 to mitigate this medium-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params["query"]["__proto__"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.