Executive brief
Tamagui is a UI toolkit used for building React and React Native applications. A security vulnerability in its configuration management component allows an attacker to modify core application settings by injecting malicious data. This could lead to application instability, unauthorized changes to how the software behaves, or potential service disruptions depending on how the application uses these configuration settings.
Technical details
A prototype pollution vulnerability exists in the `updateConfig` function within `code/core/web/src/config.ts` of Tamagui. The function accepts an arbitrary string as a configuration key and uses it to select a merge target via `Object.assign(config[key], value)` without proper validation. By providing a key such as `__proto__`, an attacker can modify `Object.prototype`, leading to the injection of properties across the JavaScript environment. This can be exploited remotely if the application exposes configuration updates to untrusted input or dynamic plugins. The issue is fixed in version 2.3.1 by adding guards to the `updateConfig` keys.
Affected products
- tamagui tamagui up to 2.3.0
Timeline
- 2026-06-11: disclosed: Issue reported on GitHub
- 2026-06-18: patched: Version 2.3.1 released
- 2026-07-14: advisory: CVE published to NVD
References
- https://github.com/tamagui/tamagui/
- https://github.com/tamagui/tamagui/commit/e46af9879b7627934ea4d6d6e46e65cea53abb3d
- https://github.com/tamagui/tamagui/issues/4029
- https://github.com/tamagui/tamagui/releases/tag/v2.3.1
- https://vuldb.com/cve/CVE-2026-15702
- https://vuldb.com/submit/856138
- https://vuldb.com/vuln/378249