@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
Description
Summary
The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.
Details
In _copyProps() (copy.ts lines 186-191), the code iterates all enumerable properties including inherited ones and dangerous keys like __proto__. Any object with a __proto__ key (e.g., from untrusted JSON input) will overwrite the target's prototype.
PoC
const malicious = JSON.parse('{"__proto__": {"polluted": true}}');
objDeepCopy(malicious);
console.log({}.polluted); // true
Suggested
Fix
Add objHasOwnProperty check and filter __proto__, constructor, prototype keys.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
_copyProps in ts-utils uses for...in without hasOwnProperty check, allowing prototype pollution via malicious JSON input.
Vulnerability
The _copyProps function in lib/src/object/copy.ts iterates over source object properties using a for...in loop without checking Object.hasOwnProperty and without filtering dangerous keys like __proto__, constructor, and prototype. This allows an attacker to pollute the prototype chain of all objects in the application [1][2].
Exploitation
An attacker can supply a crafted JSON object containing a __proto__ key, for example {"__proto__": {"polluted": true}}. When this object is passed to objDeepCopy or similar functions, the _copyProps function assigns the nested properties directly to the target's prototype, leading to global prototype pollution [1].
Impact
Successful exploitation results in prototype pollution, which can affect all objects within the application. This can lead to various security issues, including property injection, denial of service, or potentially remote code execution depending on how the polluted properties are used [1][2].
Mitigation
The issue is fixed by adding a hasOwnProperty check and filtering out dangerous keys (__proto__, constructor, prototype) in the _copyProps function. Users should update to the patched version of the ts-utils library as soon as possible [1].
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.