Prototype Pollution Vulnerability in ts-utils Library by Nevware21
CVE-2026-46681

7.2HIGH

Key Information:

Vendor

Nevware21

Status
Ts-utils
Vendor
CVE Published:
21 July 2026

What is CVE-2026-46681?

The ts-utils library, a utility for TypeScript and JavaScript applications, is susceptible to a prototype pollution vulnerability through its _copyProps function. This function improperly iterates over source object properties without validating ownership using Object.hasOwnProperty. As a result, it allows an attacker to manipulate the prototype chain of objects globally within the application. This vulnerability can lead to serious security implications, including the potential for executing arbitrary code and compromising application integrity. The issue has been mitigated in version 0.14.0 with the addition of necessary checks and filters to prevent such attacks.

Affected Version(s)

ts-utils < 0.14.0

References

https://github.com/nevware21/ts-utils/security/advisories...
x_refsource_CONFIRM
https://github.com/nevware21/ts-utils/commit/5e887f4e2fbe...
x_refsource_MISC

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.