CVE-2026-45325

Published: Jul 16, 2026Modified: Jul 17, 2026Deferred

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Exploitability: 3.9 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.

Related CWEs

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (2)

https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7

Source: security-advisories@github.com

https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94

Source: security-advisories@github.com

Timeline

No history available yet.