{"id":"GHSA-cmxg-94mg-jq94","summary":"@tmlmobilidade/utils has prototype pollution in its setValueAtPath","details":"### Impact\nPrototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().\n\n### Patches\nA fix is available in versions 20260509.0340.15 and up.","aliases":["CVE-2026-45325"],"modified":"2026-09-10T03:51:05.334255822Z","published":"2026-05-18T17:07:04Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-1321"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-05-18T17:07:04Z"},"references":[{"type":"WEB","url":"https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94"},{"type":"WEB","url":"https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7"},{"type":"PACKAGE","url":"https://github.com/tmlmobilidade/go"},{"type":"WEB","url":"https://github.com/tmlmobilidade/go/blob/prd/packages/utils/src/generic/value-at-path.ts"}],"affected":[{"package":{"name":"@tmlmobilidade/utils","ecosystem":"npm","purl":"pkg:npm/%40tmlmobilidade/utils"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260509.0340.15"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-cmxg-94mg-jq94/GHSA-cmxg-94mg-jq94.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"}]}