CVE-2026-15538

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15538", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-12T18:03:07.553Z", "datePublished": "2026-07-13T06:00:11.115Z", "dateUpdated": "2026-08-27T20:01:03.803Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-27T20:01:03.803Z"}, "title": "primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1321", "lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "primefaces", "product": "primereact", "versions": [{"version": "10.9.0", "status": "affected"}, {"version": "10.9.1", "status": "affected"}, {"version": "10.9.2", "status": "affected"}, {"version": "10.9.3", "status": "affected"}, {"version": "10.9.4", "status": "affected"}, {"version": "10.9.5", "status": "affected"}, {"version": "10.9.6", "status": "affected"}, {"version": "10.9.7", "status": "affected"}, {"version": "10.9.8", "status": "affected"}, {"version": "10.9.9", "status": "unaffected"}, {"version": "11.0.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*"], "modules": ["API"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-07-12T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-12T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-27T00:00:00.000Z", "lang": "en", "value": "Vendor acknowledged"}, {"time": "2026-08-27T00:00:00.000Z", "lang": "en", "value": "Countermeasure disclosed"}, {"time": "2026-08-27T22:05:48.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dremig (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "Mert Sincan (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/vuln/377888", "name": "VDB-377888 | primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377888/cti", "name": "VDB-377888 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15538", "name": "CVE-2026-15538 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/855024", "name": "Submit #855024 | Node.js primereact 10.9.8 Prototype Pollution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/primefaces/primereact/issues/8553", "tags": ["issue-tracking"]}, {"url": "https://github.com/primefaces/primereact/security/advisories/GHSA-hgqw-899r-rc46", "tags": ["related"]}, {"url": "https://github.com/primefaces/primereact/commit/61f182e11d9ef52032ff56f420da763a6938236f", "tags": ["patch"]}, {"url": "https://github.com/primefaces/primereact/releases/tag/10.9.9", "tags": ["patch"]}, {"url": "https://github.com/Mantle-UI/mantle-ui/issues/50", "tags": ["issue-tracking"]}, {"url": "https://github.com/primefaces/primereact/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T15:21:54.694785Z", "id": "CVE-2026-15538", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T15:22:07.104Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15538", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T15:21:54.694785Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T15:22:00.667Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "primefaces primereact API ObjectUtils.mutateFieldData prototype pollution", "credits": [{"lang": "en", "type": "reporter", "value": "Dremig (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*"], "vendor": "primefaces", "modules": ["API"], "product": "primereact", "versions": [{"status": "affected", "version": "10.9.0"}, {"status": "affected", "version": "10.9.1"}, {"status": "affected", "version": "10.9.2"}, {"status": "affected", "version": "10.9.3"}, {"status": "affected", "version": "10.9.4"}, {"status": "affected", "version": "10.9.5"}, {"status": "affected", "version": "10.9.6"}, {"status": "affected", "version": "10.9.7"}, {"status": "affected", "version": "10.9.8"}]}], "timeline": [{"lang": "en", "time": "2026-07-12T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-12T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-12T20:08:10.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/377888", "name": "VDB-377888 | primefaces primereact API ObjectUtils.mutateFieldData prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377888/cti", "name": "VDB-377888 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15538", "name": "CVE-2026-15538 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/855024", "name": "Submit #855024 | Node.js primereact 10.9.8 Prototype Pollution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/primefaces/primereact/issues/8553", "tags": ["issue-tracking"]}, {"url": "https://github.com/Mantle-UI/mantle-ui/issues/50", "tags": ["issue-tracking"]}, {"url": "https://github.com/primefaces/primereact/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-13T06:00:11.115Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15538", "state": "PUBLISHED", "dateUpdated": "2026-07-13T15:22:07.104Z", "dateReserved": "2026-07-12T18:03:07.553Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-13T06:00:11.115Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*"], "modules": ["API"], "product": "primereact", "vendor": "primefaces", "versions": [{"status": "affected", "version": "10.9.0"}, {"status": "affected", "version": "10.9.1"}, {"status": "affected", "version": "10.9.2"}, {"status": "affected", "version": "10.9.3"}, {"status": "affected", "version": "10.9.4"}, {"status": "affected", "version": "10.9.5"}, {"status": "affected", "version": "10.9.6"}, {"status": "affected", "version": "10.9.7"}, {"status": "affected", "version": "10.9.8"}, {"status": "unaffected", "version": "10.9.9"}, {"status": "unaffected", "version": "11.0.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component."}, {"lang": "es", "value": "Se ha identificado una debilidad en primefaces primereact hasta la versi\u00f3n 10.9.8. Este problema afecta a la funci\u00f3n ObjectUtils.mutateFieldData del componente API. Esta manipulaci\u00f3n del argumento Field causa una modificaci\u00f3n indebidamente controlada de atributos de prototipo de objeto. El ataque puede llevarse a cabo de forma remota. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de problema, pero a\u00fan no ha respondido. Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor."}], "id": "CVE-2026-15538", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15538", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-13T15:21:54.694785Z", "version": "2.0.3"}}]}, "published": "2026-07-13T07:16:28.813", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Mantle-UI/mantle-ui/issues/50"}, {"source": "cna@vuldb.com", "url": "https://github.com/primefaces/primereact/"}, {"source": "cna@vuldb.com", "url": "https://github.com/primefaces/primereact/commit/61f182e11d9ef52032ff56f420da763a6938236f"}, {"source": "cna@vuldb.com", "url": "https://github.com/primefaces/primereact/issues/8553"}, {"source": "cna@vuldb.com", "url": "https://github.com/primefaces/primereact/releases/tag/10.9.9"}, {"source": "cna@vuldb.com", "url": "https://github.com/primefaces/primereact/security/advisories/GHSA-hgqw-899r-rc46"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-15538"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/855024"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/377888"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/377888/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1321"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "primereact: PrimeReact: Remote attacker can modify object prototype attributes", "id": "2499590", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499590"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-915", "details": ["A flaw was found in PrimeFaces PrimeReact. A remote attacker can exploit a weakness in the ObjectUtils.mutateFieldData function within the component API. This allows for the improper modification of object prototype attributes, potentially leading to unexpected behavior or further attacks. This vulnerability affects products that are no longer supported by the maintainer."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-15538", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-gaudi-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}], "public_date": "2026-07-13T06:00:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15538\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15538\nhttps://github.com/Mantle-UI/mantle-ui/issues/50\nhttps://github.com/primefaces/primereact/\nhttps://github.com/primefaces/primereact/issues/8553\nhttps://vuldb.com/cve/CVE-2026-15538\nhttps://vuldb.com/submit/855024\nhttps://vuldb.com/vuln/377888\nhttps://vuldb.com/vuln/377888/cti"], "statement": "This Moderate flaw in PrimeFaces PrimeReact allows a remote attacker to modify object prototype attributes through the `ObjectUtils.mutateFieldData` function. This could lead to unexpected application behavior or further attacks. Red Hat Enterprise Linux AI components are affected by this vulnerability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.9.8"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "primereact", "source": "cna", "vendor": "primefaces"}, "product": "primereact", "vendor": "primefaces"}], "created": "2026-07-13T14:39:13.708599+00:00", "updated": "2026-08-28T21:00:04.563513+00:00", "vendors": ["primefaces", "primefaces$PRODUCT$primereact"]}