{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15538", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-12T18:03:07.553Z", "datePublished": "2026-07-13T06:00:11.115Z", "dateUpdated": "2026-07-13T15:22:07.104Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-13T06:00:11.115Z"}, "title": "primefaces primereact API ObjectUtils.mutateFieldData prototype pollution", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1321", "lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "primefaces", "product": "primereact", "versions": [{"version": "10.9.0", "status": "affected"}, {"version": "10.9.1", "status": "affected"}, {"version": "10.9.2", "status": "affected"}, {"version": "10.9.3", "status": "affected"}, {"version": "10.9.4", "status": "affected"}, {"version": "10.9.5", "status": "affected"}, {"version": "10.9.6", "status": "affected"}, {"version": "10.9.7", "status": "affected"}, {"version": "10.9.8", "status": "affected"}], "cpes": ["cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*"], "modules": ["API"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-12T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-12T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-12T20:08:10.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dremig (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/377888", "name": "VDB-377888 | primefaces primereact API ObjectUtils.mutateFieldData prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377888/cti", "name": "VDB-377888 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15538", "name": "CVE-2026-15538 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/855024", "name": "Submit #855024 | Node.js primereact 10.9.8 Prototype Pollution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/primefaces/primereact/issues/8553", "tags": ["issue-tracking"]}, {"url": "https://github.com/Mantle-UI/mantle-ui/issues/50", "tags": ["issue-tracking"]}, {"url": "https://github.com/primefaces/primereact/", "tags": ["product"]}], "tags": ["unsupported-when-assigned"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T15:21:54.694785Z", "id": "CVE-2026-15538", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T15:22:07.104Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15538", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T15:21:54.694785Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T15:22:00.667Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "primefaces primereact API ObjectUtils.mutateFieldData prototype pollution", "credits": [{"lang": "en", "type": "reporter", "value": "Dremig (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*"], "vendor": "primefaces", "modules": ["API"], "product": "primereact", "versions": [{"status": "affected", "version": "10.9.0"}, {"status": "affected", "version": "10.9.1"}, {"status": "affected", "version": "10.9.2"}, {"status": "affected", "version": "10.9.3"}, {"status": "affected", "version": "10.9.4"}, {"status": "affected", "version": "10.9.5"}, {"status": "affected", "version": "10.9.6"}, {"status": "affected", "version": "10.9.7"}, {"status": "affected", "version": "10.9.8"}]}], "timeline": [{"lang": "en", "time": "2026-07-12T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-12T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-12T20:08:10.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/377888", "name": "VDB-377888 | primefaces primereact API ObjectUtils.mutateFieldData prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377888/cti", "name": "VDB-377888 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15538", "name": "CVE-2026-15538 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/855024", "name": "Submit #855024 | Node.js primereact 10.9.8 Prototype Pollution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/primefaces/primereact/issues/8553", "tags": ["issue-tracking"]}, {"url": "https://github.com/Mantle-UI/mantle-ui/issues/50", "tags": ["issue-tracking"]}, {"url": "https://github.com/primefaces/primereact/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-13T06:00:11.115Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15538", "state": "PUBLISHED", "dateUpdated": "2026-07-13T15:22:07.104Z", "dateReserved": "2026-07-12T18:03:07.553Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-13T06:00:11.115Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "primereact: PrimeReact: Remote attacker can modify object prototype attributes", "id": "2499590", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499590"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-915", "details": ["A flaw was found in PrimeFaces PrimeReact. A remote attacker can exploit a weakness in the ObjectUtils.mutateFieldData function within the component API. This allows for the improper modification of object prototype attributes, potentially leading to unexpected behavior or further attacks. This vulnerability affects products that are no longer supported by the maintainer."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-15538", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-gaudi-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}], "public_date": "2026-07-13T06:00:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15538\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15538\nhttps://github.com/Mantle-UI/mantle-ui/issues/50\nhttps://github.com/primefaces/primereact/\nhttps://github.com/primefaces/primereact/issues/8553\nhttps://vuldb.com/cve/CVE-2026-15538\nhttps://vuldb.com/submit/855024\nhttps://vuldb.com/vuln/377888\nhttps://vuldb.com/vuln/377888/cti"], "statement": "This Moderate flaw in PrimeFaces PrimeReact allows a remote attacker to modify object prototype attributes through the `ObjectUtils.mutateFieldData` function. This could lead to unexpected application behavior or further attacks. Red Hat Enterprise Linux AI components are affected by this vulnerability.", "threat_severity": "Moderate"}