@tmlmobilidade/utils has prototype pollution in its setValueAtPath

Description

Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().

Recommendation

Update the @tmlmobilidade/utils package to the latest compatible version. Followings are version details:

• Affected version(s): < 20260509.0340.15
• Patched version(s): 20260509.0340.15

References

• GHSA-cmxg-94mg-jq94
• CVE-2026-45325
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
• Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection - CVE-2026-33916
• @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
• Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@tmlmobilidade/utils