@tmlmobilidade/utils has prototype pollution in its setValueAtPath

Vulnerability

The setValueAtPath function in the @tmlmobilidade/utils npm package is vulnerable to prototype pollution. The function does not sanitize the path parameter, allowing an attacker to set properties on Object.prototype by passing paths such as __proto__ or constructor.prototype. Affected versions are those prior to 20260509.0340.15 [1][2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication or user interaction. The attack complexity is low, requiring only the ability to supply a crafted path argument to setValueAtPath. For example, an attacker could send a request that triggers the vulnerable code path with a malicious path string, leading to prototype pollution [2][4].

Impact

Successful exploitation allows the attacker to pollute Object.prototype, injecting arbitrary properties into all objects in the application. This can lead to denial of service, privilege escalation, or remote code execution, depending on how the polluted properties are used by the application [2][4].

Mitigation

The vulnerability is fixed in version 20260509.0340.15 and later. Users should upgrade to this version or newer. No workarounds are documented in the available references [2][4].