Description
Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().
Recommendation
Update the @tmlmobilidade/utils package to the latest compatible version. Followings are version details:
- Affected version(s): < 20260509.0340.15
- Patched version(s): 20260509.0340.15
References
Could your website be exposed too?
SmartScanner can check your website for @tmlmobilidade/utils has prototype pollution in its setValueAtPath and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection - CVE-2026-33916
- @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
- Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966
You might also like:
See something that needs correcting? Let us knowUpdated May 18, 2026