GitHub Advisoryadvisory · npm

GHSA-cmxg-94mg-jq94 @tmlmobilidade/utils has prototype pollution in its setValueAtPath

HIGH Published 2026-05-18 Modified 2026-05-18 Official page ↗
Aliases
CVE-2026-45325
Ecosystem
npm
Packages
@tmlmobilidade/utils
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weaknesses
CWE-1321
Reviewed
2026-05-18

Affected packages

• npm @tmlmobilidade/utils: < 20260509.0340.15 → fixed in 20260509.0340.15

Description

Impact Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath(). Patches A fix is available in versions 20260509.0340.15 and up.

Related

Alias · CVE (1)

  • CVE-2026-45325 Gestor de Oferta is a web application for managing mobility service offerings. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References