Executive brief
PrimeReact is a popular library of user interface components for React applications. A security vulnerability has been found in a utility function that handles data updates, which could allow an attacker to modify the fundamental behavior of the application. This could lead to unauthorized access, changes to application settings, or service disruptions, though the project is currently archived and may not receive an official fix.
Technical details
A prototype pollution vulnerability exists in the ObjectUtils.mutateFieldData function within the primereact/utils component of PrimeReact up to version 10.9.8. The function fails to properly sanitize path segments when splitting the 'field' argument by dots, allowing traversal into sensitive attributes like '__proto__', 'constructor', and 'prototype'. A remote attacker with the ability to provide input to this function can pollute the global Object.prototype. This can result in the bypass of security checks, modification of application logic, or denial of service. As the repository was archived in June 2026, no official patch is currently available.
Affected products
- primefaces primereact up to 10.9.8
Timeline
- 2026-06-10: disclosed: Issue reported to PrimeReact maintainers via GitHub issue #8553
- 2026-06-28: other: PrimeReact repository archived by owner
- 2026-07-13: advisory: CVE-2026-15538 published by NVD/VulDB