{"id":"CVE-2026-48819","summary":"Hey API: `buildClientParams` template: prototype chain substitution via unknown `$\u003cslot\u003e___proto__` key","details":"Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params[\"query\"][\"__proto__\"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.","aliases":["GHSA-hhx9-57xq-r5rw"],"modified":"2026-07-25T03:56:47.758441212Z","published":"2026-07-17T19:46:00.402Z","database_specific":{"cwe_ids":["CWE-1321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48819.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48819.json"},{"type":"ADVISORY","url":"https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48819"},{"type":"FIX","url":"https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f"},{"type":"FIX","url":"https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hey-api/hey-api","events":[{"introduced":"0"},{"fixed":"023909137a15eff9c0263d3bcd116140076b214f"},{"fixed":"da321a1529eb3c90d2109da870f514b915a60169"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.97.3"}]}}],"versions":["@hey-api/shared@0.4.2","@hey-api/openapi-ts@0.97.0","@hey-api/codegen-core@0.8.1","2026-04-28","2026-04-20","@hey-api/shared@0.3.0","@hey-api/openapi-ts@0.95.0","2026-04-13","@hey-api/openapi-ts@0.94.4","@hey-api/shared@0.2.5","@hey-api/openapi-ts@0.94.3","@hey-api/codegen-core@0.7.4","@hey-api/types@0.1.4","@hey-api/shared@0.2.4","@hey-api/openapi-ts@0.94.2","@hey-api/codegen-core@0.7.3","@hey-api/shared@0.2.3","@hey-api/openapi-ts@0.94.1","@hey-api/codegen-core@0.7.2","@hey-api/shared@0.2.2","@hey-api/openapi-ts@0.94.0","@hey-api/codegen-core@0.7.1","@hey-api/openapi-ts@0.93.1","@hey-api/shared@0.2.1","@hey-api/openapi-ts@0.93.0","@hey-api/json-schema-ref-parser@1.3.1","@hey-api/shared@0.2.0","@hey-api/openapi-ts@0.92.4","@hey-api/json-schema-ref-parser@1.3.0","@hey-api/openapi-ts@0.92.3","@hey-api/shared@0.1.2","@hey-api/openapi-ts@0.92.2","@hey-api/codegen-core@0.7.0","@hey-api/shared@0.1.1","@hey-api/openapi-ts@0.91.1","@hey-api/codegen-core@0.6.1","@hey-api/types@0.1.3","@hey-api/shared@0.1.0","@hey-api/openapi-ts@0.91.0","@hey-api/codegen-core@0.6.0","@hey-api/openapi-ts@0.90.10","@hey-api/types@0.1.2","@hey-api/openapi-ts@0.90.9","@hey-api/codegen-core@0.5.5","@hey-api/openapi-ts@0.90.8","@hey-api/codegen-core@0.5.4","@hey-api/openapi-ts@0.90.7","@hey-api/codegen-core@0.5.3","@hey-api/openapi-ts@0.90.6","@hey-api/types@0.1.1","@hey-api/openapi-ts@0.90.4","@hey-api/openapi-ts@0.90.3","@hey-api/vite-plugin@0.2.1","@hey-api/openapi-ts@0.90.2","@hey-api/codegen-core@0.5.2","@hey-api/openapi-ts@0.90.1","@hey-api/codegen-core@0.5.1","@hey-api/openapi-ts@0.90.0","@hey-api/codegen-core@0.5.0","@hey-api/openapi-ts@0.89.2","@hey-api/openapi-ts@0.89.1","@hey-api/openapi-ts@0.89.0","@hey-api/codegen-core@0.4.0","@hey-api/openapi-ts@0.88.2","@hey-api/openapi-ts@0.88.1","@hey-api/openapi-ts@0.88.0","@hey-api/openapi-ts@0.87.5","@hey-api/openapi-ts@0.87.4","@hey-api/openapi-ts@0.87.3","@hey-api/openapi-ts@0.87.2","@hey-api/openapi-ts@0.87.1","@hey-api/openapi-ts@0.87.0","@hey-api/openapi-ts@0.86.12","@hey-api/codegen-core@0.3.3","@hey-api/openapi-ts@0.86.11","@hey-api/openapi-ts@0.86.10","@hey-api/openapi-ts@0.86.9","@hey-api/codegen-core@0.3.2","@hey-api/openapi-ts@0.86.8","@hey-api/openapi-ts@0.86.7","@hey-api/openapi-ts@0.86.6","@hey-api/openapi-ts@0.86.5","@hey-api/openapi-ts@0.86.4","@hey-api/openapi-ts@0.86.3","@hey-api/openapi-ts@0.86.2","@hey-api/codegen-core@0.3.1","@hey-api/openapi-ts@0.86.1","@hey-api/openapi-ts@0.86.0","@hey-api/codegen-core@0.3.0","@hey-api/openapi-ts@0.85.2","@hey-api/openapi-ts@0.85.1","@hey-api/openapi-ts@0.85.0","@hey-api/openapi-ts@0.84.4","@hey-api/openapi-ts@0.84.3","@hey-api/openapi-ts@0.84.2","@hey-api/openapi-ts@0.83.1","@hey-api/openapi-ts@0.84.1","@hey-api/openapi-ts@0.84.0","@hey-api/codegen-core@0.2.0","@hey-api/openapi-ts@0.83.0","@hey-api/codegen-core@0.1.0","@hey-api/openapi-ts@0.82.5","@hey-api/openapi-ts@0.82.4","@hey-api/nuxt@0.2.1","@hey-api/openapi-ts@0.82.0","@hey-api/openapi-ts@0.82.1","@hey-api/openapi-ts@0.81.1","@hey-api/openapi-ts@0.81.0","@hey-api/openapi-ts@0.80.18","@hey-api/openapi-ts@0.80.17","@hey-api/openapi-ts@0.80.16","@hey-api/openapi-ts@0.80.15","@hey-api/openapi-ts@0.80.14","@hey-api/openapi-ts@0.80.13","@hey-api/openapi-ts@0.80.12","@hey-api/openapi-ts@0.80.11","@hey-api/openapi-ts@0.80.10","@hey-api/openapi-ts@0.80.9","@hey-api/openapi-ts@0.80.8","@hey-api/openapi-ts@0.80.7","@hey-api/openapi-ts@0.80.6","@hey-api/openapi-ts@0.80.4","@hey-api/openapi-ts@0.80.5","@hey-api/openapi-ts@0.80.3","@hey-api/openapi-ts@0.80.2","@hey-api/openapi-ts@0.80.1","@hey-api/openapi-ts@0.80.0","@hey-api/openapi-ts@0.79.2","@hey-api/openapi-ts@0.79.1","@hey-api/openapi-ts@0.79.0","@hey-api/openapi-ts@0.78.3","@hey-api/openapi-ts@0.78.1","@hey-api/openapi-ts@0.78.2","@hey-api/openapi-ts@0.78.0","@hey-api/openapi-ts@0.77.0","@hey-api/openapi-ts@0.76.0","@hey-api/openapi-ts@0.75.0","@hey-api/openapi-ts@0.74.0","@hey-api/nuxt@0.2.0","@hey-api/openapi-ts@0.73.0","@hey-api/openapi-ts@0.72.2","@hey-api/client-next@0.5.1","@hey-api/client-fetch@0.13.1","@hey-api/client-axios@0.9.1","@hey-api/openapi-ts@0.72.1","@hey-api/openapi-ts@0.72.0","@hey-api/client-next@0.5.0","@hey-api/client-fetch@0.13.0","@hey-api/client-axios@0.9.0","@hey-api/openapi-ts@0.71.1","@hey-api/openapi-ts@0.71.0","@hey-api/openapi-ts@0.70.0","@hey-api/client-fetch@0.12.0","@hey-api/openapi-ts@0.69.2","@hey-api/openapi-ts@0.69.1","@hey-api/openapi-ts@0.69.0","@hey-api/client-next@0.4.0","@hey-api/client-fetch@0.11.0","@hey-api/client-axios@0.8.0","@hey-api/openapi-ts@0.68.1","@hey-api/openapi-ts@0.68.0","@hey-api/client-next@0.3.2","@hey-api/client-fetch@0.10.2","@hey-api/nuxt@0.1.7","@hey-api/openapi-ts@0.67.5","@hey-api/nuxt@0.1.6","@hey-api/openapi-ts@0.67.3","@hey-api/openapi-ts@0.67.2","@hey-api/openapi-ts@0.67.1","@hey-api/openapi-ts@0.67.0","@hey-api/openapi-ts@0.66.7","@hey-api/openapi-ts@0.66.6","@hey-api/openapi-ts@0.66.5","@hey-api/nuxt@0.1.5","@hey-api/openapi-ts@0.66.3","@hey-api/openapi-ts@0.66.2","@hey-api/openapi-ts@0.66.1","@hey-api/client-fetch@0.10.0","@hey-api/openapi-ts@0.66.0","@hey-api/openapi-ts@0.65.0","@hey-api/nuxt@0.1.4","@hey-api/client-nuxt@0.4.0","@hey-api/client-next@0.3.0","@hey-api/client-fetch@0.9.0","@hey-api/client-axios@0.7.0","@hey-api/openapi-ts@0.64.15","@hey-api/nuxt@0.1.3","@hey-api/client-nuxt@0.3.1","@hey-api/client-next@0.2.4","@hey-api/client-fetch@0.8.4","@hey-api/client-axios@0.6.3","@hey-api/openapi-ts@0.64.14","@hey-api/vite-plugin@0.2.0","@hey-api/rollup-plugin@0.1.2","@hey-api/rollup-plugin@0.1.1","@hey-api/openapi-ts@0.64.13","@hey-api/nuxt@0.1.2","@hey-api/openapi-ts@0.64.12","@hey-api/nuxt@0.1.1","@hey-api/rollup-plugin@0.1.0","@hey-api/openapi-ts@0.64.11","@hey-api/nuxt@0.1.0","@hey-api/client-nuxt@0.3.0","@hey-api/openapi-ts@0.64.10","@hey-api/openapi-ts@0.64.9","@hey-api/client-nuxt@0.2.4","@hey-api/client-next@0.2.3","@hey-api/client-fetch@0.8.3","@hey-api/client-axios@0.6.2","@hey-api/openapi-ts@0.64.8","@hey-api/openapi-ts@0.64.7","@hey-api/client-nuxt@0.2.3","@hey-api/client-next@0.2.2","@hey-api/client-fetch@0.8.2","@hey-api/openapi-ts@0.64.6","@hey-api/openapi-ts@0.64.5","@hey-api/openapi-ts@0.64.4","@hey-api/openapi-ts@0.64.3","@hey-api/client-nuxt@0.2.2","@hey-api/openapi-ts@0.64.2","@hey-api/client-nuxt@0.2.1","@hey-api/client-next@0.2.1","@hey-api/client-fetch@0.8.1","@hey-api/client-axios@0.6.1","@hey-api/openapi-ts@0.62.1","@hey-api/openapi-ts@0.64.1","@hey-api/openapi-ts@0.64.0","@hey-api/client-nuxt@0.2.0","@hey-api/client-next@0.2.0","@hey-api/client-fetch@0.8.0","@hey-api/client-axios@0.6.0","@hey-api/openapi-ts@0.63.2","@hey-api/openapi-ts@0.63.1","@hey-api/client-nuxt@0.1.3","@hey-api/client-next@0.1.0","@hey-api/client-fetch@0.7.3","@hey-api/client-axios@0.5.3","@hey-api/openapi-ts@0.63.0","@hey-api/client-nuxt@0.1.2","@hey-api/client-fetch@0.7.2","@hey-api/client-axios@0.5.2","@hey-api/openapi-ts@0.62.3","@hey-api/client-nuxt@0.1.1","@hey-api/client-fetch@0.7.1","@hey-api/client-axios@0.5.1","@hey-api/openapi-ts@0.62.2","@hey-api/client-nuxt@0.1.0","@hey-api/openapi-ts@0.62.0","@hey-api/client-fetch@0.7.0","@hey-api/client-axios@0.5.0","@hey-api/openapi-ts@0.61.3","@hey-api/openapi-ts@0.61.2","@hey-api/openapi-ts@0.61.1","@hey-api/openapi-ts@0.61.0","@hey-api/client-fetch@0.6.0","@hey-api/client-axios@0.4.0","@hey-api/openapi-ts@0.60.1","@hey-api/client-fetch@0.5.7","@hey-api/client-axios@0.3.4","@hey-api/client-fetch@0.5.6","@hey-api/client-axios@0.3.3","@hey-api/openapi-ts@0.60.0","@hey-api/client-fetch@0.5.5","@hey-api/client-axios@0.3.2","@hey-api/client-fetch@0.5.4","@hey-api/client-axios@0.3.1","@hey-api/openapi-ts@0.59.2","@hey-api/client-fetch@0.5.3","@hey-api/client-axios@0.3.0","@hey-api/openapi-ts@0.59.1","@hey-api/client-fetch@0.5.2","@hey-api/client-axios@0.2.12","@hey-api/openapi-ts@0.59.0","@hey-api/client-fetch@0.5.1","@hey-api/openapi-ts@0.58.0","@hey-api/openapi-ts@0.57.1","@hey-api/client-fetch@0.5.0","@hey-api/client-axios@0.2.11","@hey-api/openapi-ts@0.57.0","@hey-api/openapi-ts@0.56.3","@hey-api/openapi-ts@0.56.2","@hey-api/openapi-ts@0.56.1","@hey-api/openapi-ts@0.56.0","@hey-api/client-fetch@0.4.4","@hey-api/openapi-ts@0.55.3","@hey-api/openapi-ts@0.55.2","@hey-api/client-fetch@0.4.3","@hey-api/client-axios@0.2.10","@hey-api/openapi-ts@0.55.1","@hey-api/openapi-ts@0.55.0","@hey-api/openapi-ts@0.54.4","@hey-api/openapi-ts@0.54.3","@hey-api/openapi-ts@0.54.2","@hey-api/openapi-ts@0.54.1","@hey-api/openapi-ts@0.54.0","@hey-api/openapi-ts@0.53.12","@hey-api/openapi-ts@0.53.11","@hey-api/client-fetch@0.4.2","@hey-api/client-axios@0.2.9","@hey-api/openapi-ts@0.53.10","@hey-api/client-fetch@0.4.1","@hey-api/client-axios@0.2.8","@hey-api/openapi-ts@0.53.9","@hey-api/openapi-ts@0.53.8","@hey-api/openapi-ts@0.53.7","@hey-api/openapi-ts@0.53.6","@hey-api/client-fetch@0.4.0","@hey-api/openapi-ts@0.53.5","@hey-api/client-fetch@0.3.4","@hey-api/client-axios@0.2.7","@hey-api/openapi-ts@0.53.4","@hey-api/client-fetch@0.3.3","@hey-api/client-axios@0.2.6","@hey-api/openapi-ts@0.53.3","@hey-api/client-fetch@0.3.2","@hey-api/client-axios@0.2.5","@hey-api/openapi-ts@0.53.2","@hey-api/client-fetch@0.3.1","@hey-api/client-axios@0.2.4","@hey-api/openapi-ts@0.53.1","@hey-api/client-fetch@0.3.0","@hey-api/openapi-ts@0.53.0","@hey-api/openapi-ts@0.52.11","@hey-api/openapi-ts@0.52.10","@hey-api/openapi-ts@0.52.9","@hey-api/openapi-ts@0.52.8","@hey-api/openapi-ts@0.52.7","@hey-api/openapi-ts@0.52.6","@hey-api/openapi-ts@0.52.5","@hey-api/client-fetch@0.2.4","@hey-api/client-axios@0.2.3","@hey-api/openapi-ts@0.52.4","@hey-api/client-fetch@0.2.3","@hey-api/client-axios@0.2.2","@hey-api/openapi-ts@0.52.3","@hey-api/openapi-ts@0.52.2","@hey-api/client-fetch@0.2.2","@hey-api/openapi-ts@0.52.1","@hey-api/client-fetch@0.2.1","@hey-api/client-axios@0.2.1","@hey-api/openapi-ts@0.52.0","@hey-api/client-fetch@0.2.0","@hey-api/client-axios@0.2.0","@hey-api/client-fetch@0.1.14","@hey-api/client-fetch@0.1.13","@hey-api/openapi-ts@0.51.0","@hey-api/openapi-ts@0.50.2","@hey-api/client-fetch@0.1.12","@hey-api/client-axios@0.1.1","@hey-api/openapi-ts@0.50.1","@hey-api/openapi-ts@0.50.0","@hey-api/client-fetch@0.1.11","@hey-api/client-axios@0.1.0","@hey-api/openapi-ts@0.49.0","@hey-api/client-fetch@0.1.10","@hey-api/openapi-ts@0.48.3","@hey-api/client-fetch@0.1.9","@hey-api/client-fetch@0.1.8","@hey-api/openapi-ts@0.48.2","@hey-api/openapi-ts@0.48.1","@hey-api/client-fetch@0.1.7","@hey-api/openapi-ts@0.48.0","@hey-api/openapi-ts@0.47.2","@hey-api/client-fetch@0.1.6","@hey-api/openapi-ts@0.47.1","@hey-api/client-fetch@0.1.5","@hey-api/openapi-ts@0.47.0","@hey-api/client-fetch@0.1.4","@hey-api/client-fetch@0.1.3","@hey-api/openapi-ts@0.46.3","@hey-api/openapi-ts@0.46.2","@hey-api/client-fetch@0.1.2","@hey-api/openapi-ts@0.46.1","@hey-api/client-fetch@0.1.1","@hey-api/openapi-ts@0.46.0","@hey-api/client-fetch@0.1.0","@hey-api/openapi-ts@0.45.1","@hey-api/openapi-ts@0.45.0","@hey-api/openapi-ts@0.44.0","@hey-api/openapi-ts@0.43.2","@hey-api/openapi-ts@0.43.1","@hey-api/openapi-ts@0.43.0","@hey-api/openapi-ts@0.42.1","@hey-api/openapi-ts@0.42.0","@hey-api/openapi-ts@0.41.0","@hey-api/openapi-ts@0.40.2","@hey-api/openapi-ts@0.40.1","@hey-api/openapi-ts@0.40.0","@hey-api/openapi-ts@0.39.0","@hey-api/openapi-ts@0.38.1","@hey-api/openapi-ts@0.38.0","@hey-api/openapi-ts@0.37.3","@hey-api/openapi-ts@0.37.2","@hey-api/openapi-ts@0.37.1","@hey-api/openapi-ts@0.37.0","@hey-api/openapi-ts@0.36.2","@hey-api/openapi-ts@0.36.1","@hey-api/openapi-ts@0.36.0","@hey-api/openapi-ts@0.35.0","@hey-api/openapi-ts@0.34.5","@hey-api/openapi-ts@0.34.4","@hey-api/openapi-ts@0.34.3","@hey-api/openapi-ts@0.34.2","@hey-api/openapi-ts@0.34.1","@hey-api/openapi-ts@0.34.0","v0.33.2","v0.33.1","v0.33.0","v0.32.1","v0.32.0","v0.31.1","v0.31.0","v0.30.0","v0.29.2","v0.29.1","v0.29.0","v0.28.0","v0.27.39"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48819.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}