Search
Find a vulnerability
Search criteria
2 vulnerabilities found for primereact by primefaces
CVE-2026-15538 (GCVE-0-2026-15538)
Vulnerability from nvd – Published: 2026-07-13 06:00 – Updated: 2026-07-13 15:22 Unsupported When Assigned
VLAI
EPSS
VEX
Title
primefaces primereact API ObjectUtils.mutateFieldData prototype pollution
Summary
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377888 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/377888/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15538 | third-party-advisory |
| https://vuldb.com/submit/855024 | third-party-advisory |
| https://github.com/primefaces/primereact/issues/8553 | issue-tracking |
| https://github.com/Mantle-UI/mantle-ui/issues/50 | issue-tracking |
| https://github.com/primefaces/primereact/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| primefaces | primereact |
Affected:
10.9.0
Affected: 10.9.1 Affected: 10.9.2 Affected: 10.9.3 Affected: 10.9.4 Affected: 10.9.5 Affected: 10.9.6 Affected: 10.9.7 Affected: 10.9.8 cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15538",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T15:21:54.694785Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T15:22:07.104Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*"
],
"modules": [
"API"
],
"product": "primereact",
"vendor": "primefaces",
"versions": [
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.9.1"
},
{
"status": "affected",
"version": "10.9.2"
},
{
"status": "affected",
"version": "10.9.3"
},
{
"status": "affected",
"version": "10.9.4"
},
{
"status": "affected",
"version": "10.9.5"
},
{
"status": "affected",
"version": "10.9.6"
},
{
"status": "affected",
"version": "10.9.7"
},
{
"status": "affected",
"version": "10.9.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dremig (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T06:00:11.115Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377888 | primefaces primereact API ObjectUtils.mutateFieldData prototype pollution",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/377888"
},
{
"name": "VDB-377888 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377888/cti"
},
{
"name": "CVE-2026-15538 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15538"
},
{
"name": "Submit #855024 | Node.js primereact 10.9.8 Prototype Pollution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/855024"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/primefaces/primereact/issues/8553"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Mantle-UI/mantle-ui/issues/50"
},
{
"tags": [
"product"
],
"url": "https://github.com/primefaces/primereact/"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-12T20:08:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "primefaces primereact API ObjectUtils.mutateFieldData prototype pollution"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15538",
"datePublished": "2026-07-13T06:00:11.115Z",
"dateReserved": "2026-07-12T18:03:07.553Z",
"dateUpdated": "2026-07-13T15:22:07.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15538 (GCVE-0-2026-15538)
Vulnerability from cvelistv5 – Published: 2026-07-13 06:00 – Updated: 2026-07-13 15:22 Unsupported When Assigned
VLAI
EPSS
VEX
Title
primefaces primereact API ObjectUtils.mutateFieldData prototype pollution
Summary
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377888 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/377888/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15538 | third-party-advisory |
| https://vuldb.com/submit/855024 | third-party-advisory |
| https://github.com/primefaces/primereact/issues/8553 | issue-tracking |
| https://github.com/Mantle-UI/mantle-ui/issues/50 | issue-tracking |
| https://github.com/primefaces/primereact/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| primefaces | primereact |
Affected:
10.9.0
Affected: 10.9.1 Affected: 10.9.2 Affected: 10.9.3 Affected: 10.9.4 Affected: 10.9.5 Affected: 10.9.6 Affected: 10.9.7 Affected: 10.9.8 cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15538",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T15:21:54.694785Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T15:22:07.104Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*"
],
"modules": [
"API"
],
"product": "primereact",
"vendor": "primefaces",
"versions": [
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.9.1"
},
{
"status": "affected",
"version": "10.9.2"
},
{
"status": "affected",
"version": "10.9.3"
},
{
"status": "affected",
"version": "10.9.4"
},
{
"status": "affected",
"version": "10.9.5"
},
{
"status": "affected",
"version": "10.9.6"
},
{
"status": "affected",
"version": "10.9.7"
},
{
"status": "affected",
"version": "10.9.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dremig (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T06:00:11.115Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377888 | primefaces primereact API ObjectUtils.mutateFieldData prototype pollution",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/377888"
},
{
"name": "VDB-377888 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377888/cti"
},
{
"name": "CVE-2026-15538 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15538"
},
{
"name": "Submit #855024 | Node.js primereact 10.9.8 Prototype Pollution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/855024"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/primefaces/primereact/issues/8553"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Mantle-UI/mantle-ui/issues/50"
},
{
"tags": [
"product"
],
"url": "https://github.com/primefaces/primereact/"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-12T20:08:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "primefaces primereact API ObjectUtils.mutateFieldData prototype pollution"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15538",
"datePublished": "2026-07-13T06:00:11.115Z",
"dateReserved": "2026-07-12T18:03:07.553Z",
"dateUpdated": "2026-07-13T15:22:07.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}