CVE-2026-46681 in ts-utils
Summary
by MITRE • 07/21/2026
@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Version 0.14.0 patches the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in @nevware21/ts-utils library represents a critical prototype pollution flaw that has significant implications for application security. The affected version contains a function named _copyProps located in lib/src/object/copy.ts which employs a for...in loop to iterate through source object properties without proper validation mechanisms. This implementation pattern creates an exploitable condition where attacker-controlled input can manipulate the prototype chain of objects within the application's runtime environment.
The technical flaw stems from the absence of proper property validation before copying attributes from one object to another. When the function processes a source object containing properties with names like _proto_, constructor, or prototype, these dangerous keys are directly copied to the target object without filtering. This behavior violates fundamental security principles and creates a pathway for malicious actors to inject malicious code into the application's prototype chain, potentially affecting all objects that inherit from the polluted prototypes.
The operational impact of this vulnerability extends beyond simple property manipulation as it enables attackers to achieve arbitrary code execution and bypass security controls within JavaScript applications. When prototype pollution occurs through the _copyProps function, any subsequent object instantiation or prototype-based operations may be compromised. The vulnerability is particularly dangerous because it can affect the entire application's object model, making it difficult to contain and remediate. This type of vulnerability aligns with CWE-471 which addresses the improper handling of prototype pollution in software systems.
The security implications are further amplified when considering that this vulnerability affects a utility library commonly used across multiple applications and frameworks. Attackers can leverage this flaw to manipulate core JavaScript objects, potentially leading to denial of service conditions, data corruption, or even remote code execution depending on how the polluted prototypes are subsequently used within the application. The issue demonstrates a classic security anti-pattern where insufficient input validation leads to widespread system compromise.
Mitigation strategies should include immediate upgrade to version 0.14.0 which implements proper filtering mechanisms for dangerous prototype keys. Organizations should also implement runtime monitoring to detect unusual prototype modifications and consider implementing additional defensive programming practices such as using Object.freeze on critical objects or employing alternative object copying methods that do not rely on for...in loops without proper validation. The fix addresses the core issue by incorporating proper property name validation before copying attributes, preventing the propagation of dangerous keys through the prototype chain. This remediation approach aligns with ATT&CK technique T1574.006 which focuses on avoiding the manipulation of system objects and maintaining proper object integrity in application code execution environments.