{"id":"GHSA-cmxg-94mg-jq94","revision":"6f0011ec70a748ec95739e0d728c7ec4","records":[{"revision":"6f0011ec70a748ec95739e0d728c7ec4","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-cmxg-94mg-jq94","aliases":["CVE-2026-45325"],"title":"@tmlmobilidade/utils has prototype pollution in its setValueAtPath","description":"### Impact\nPrototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().\n\n### Patches\nA fix is available in versions 20260509.0340.15 and up.","state":0,"publishedAt":"2026-05-18T17:07:04+00:00","modifiedAt":"2026-09-10T03:51:05.3342558+00:00","affected":[{"ecosystem":"npm","name":"@tmlmobilidade/utils","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"20260509.0340.15"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94","https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7","https://github.com/tmlmobilidade/go","https://github.com/tmlmobilidade/go/blob/prd/packages/utils/src/generic/value-at-path.ts"],"sourceUrl":"https://github.com/advisories/GHSA-cmxg-94mg-jq94","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cmxg-94mg-jq94","identifiers":["GHSA-cmxg-94mg-jq94","CVE-2026-45325"]},"retained":false,"historicalAffected":[]}],"coverage":[]}