CVE-2026-46681

Description

@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

Overview

State

—

Assigner (CNA)

—

CVSS severity

critical

CVSS score

9.8 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Effective score

9.8 / 10 CRITICAL source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-46681

Linked Threat

CVE-2026-46681 — CVE-2026-46681

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-46260

Assigner

GitHub_M

Published

Jul 21, 2026, 2:02:03 PM

Updated

Jul 21, 2026, 3:00:58 PM

EUVD base score (CVSS 4.0)

7.2 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

EUVD-reported EPSS

0.2800

Vendors

nevware21

Products

ts-utils (< 0.14.0)

Aliases

GHSA-x7j8-49r8-mr43

ENISA description: @nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Version 0.14.0 patches the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-46681 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-46681 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Microsoft Patch Tuesday for May 2026 — Snort rules and prominent ...
  web:blog.talosintelligence.com

  Microsoft has released its monthly security update for May 2026 , which includes 137 vulnerabilities affecting a range of products, including 16 that Microsoft marked as "critical".

  2026-05-26 02:59 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 02:59 UTC
• Microsoft January 2026 Security Updates (FYI) - Microsoft Q&A
  web:learn.microsoft.com

  January 2026 Security Updates This release consists of the following 112 Microsoft CVEs : Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations ? Windows Deployment Services CVE - 2026 -0386 SQL Server CVE - 2026 -20803 Windows Hello…

  2026-05-26 02:59 UTC
• Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
  web:thehackernews.com

  Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE - 2026 -41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender ...

  2026-05-26 02:59 UTC
• Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws
  web:www.bleepingcomputer.com

  Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.

  2026-05-26 02:59 UTC
• CISA orders feds to patch BlueHammer flaw exploited as zero-day
  web:www.bleepingcomputer.com

  CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation flaw (dubbed BlueHammer) that has been exploited in zero-day attacks.

  2026-05-26 02:59 UTC
• Critical Patches Issued for Microsoft Products, April 14, 2026
  web:www.cisecurity.org

  <p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

  2026-05-26 02:59 UTC
• April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
  web:www.crowdstrike.com

  Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

  2026-05-26 02:59 UTC
• Microsoft Confirms Active 0-Day Exploit—Check Emergency Mitigation
  web:www.forbes.com

  Updated May 17: This article, originally published May 16, has been updated to include further details on the emergency mitigation process recommended after the CVE - 2026 -42897 Microsoft Exchange ...

  2026-05-26 02:59 UTC
• Microsoft confirms two major Defender security issues - TechRadar
  web:www.techradar.com

  Microsoft patches two actively exploited zero‑day flaws in Defender, tracked as CVE‑2026‑41091 (privilege escalation) and CVE‑2026‑45498 (denial of service) Updates were shipped ...

  2026-05-26 02:59 UTC

Only Available for Registered Users. Sign in to view.