{"id":"CVE-2026-45325","aliases":["AZL-110400","AZL-110403","EUVD-2026-44971","GHSA-cmxg-94mg-jq94"],"status":"published","title":"Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath","description":"Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00464,"percentile":0.40668,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-05-18T17:07:04Z","modified":"2026-11-05T20:15:05Z","fixes":[{"ecosystem":"npm","package":"@tmlmobilidade/utils","fixed_in":["20260509.0340.15","20260509.340.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@tmlmobilidade/utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260509.0340.15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"npm","package":"@tmlmobilidade/utils","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20260509.340.15"}]}]}],"products":[{"vendor":"ecies","product":"go"},{"vendor":"tmlmobilidade","product":"go"}],"references":[{"url":"https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/tmlmobilidade/go/blob/prd/packages/utils/src/generic/value-at-path.ts","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cmxg-94mg-jq94"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45325","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45325.json","tags":["advisory"]},{"url":"https://github.com/tmlmobilidade/go","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-45325","title":"Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath","description":"Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.","status":"published","published":"2026-07-16T16:41:30.157Z","modified":"2026-07-17T18:06:58.358Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-44971","description":"Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.","status":"published","published":"2026-07-16T16:41:30Z","modified":"2026-07-17T18:06:58Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:19:50.451546Z"}],"ghsa":[{"id":"GHSA-cmxg-94mg-jq94","title":"@tmlmobilidade/utils has prototype pollution in its setValueAtPath","description":"### Impact\nPrototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().\n\n### Patches\nA fix is available in versions 20260509.0340.15 and up.","status":"published","published":"2026-05-18T17:07:04Z","modified":"2026-05-18T17:07:04Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:40:11.298154Z"}],"nvd":[{"id":"CVE-2026-45325","description":"Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.","status":"published","published":"2026-07-16T17:16:56.16Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-45325","title":"Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath","description":"Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.","status":"published","published":"2026-07-16T16:41:30.157Z","modified":"2026-10-28T02:31:09.725059656Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:05.525666Z"},{"id":"GHSA-cmxg-94mg-jq94","title":"@tmlmobilidade/utils has prototype pollution in its setValueAtPath","description":"### Impact\nPrototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().\n\n### Patches\nA fix is available in versions 20260509.340.15 and up.","status":"published","published":"2026-05-18T17:07:04Z","modified":"2026-11-05T20:15:05.446189622Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-05T20:29:31.667647Z"},{"id":"AZL-110400","title":"CVE-2026-45325 affecting package golang 1.26.7-1","description":"Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.","status":"published","published":"2026-07-16T17:16:56Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.368326Z"},{"id":"AZL-110403","title":"CVE-2026-45325 affecting package golang 1.27.1-1","description":"Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.","status":"published","published":"2026-07-16T17:16:56Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.368326Z"}]}}