Executive brief
A vulnerability exists in the @nevware21/ts-utils library, a collection of utility functions for TypeScript and JavaScript developers. A flaw in how the library copies object properties allows an attacker to inject malicious data that modifies the behavior of all objects within the application. This can lead to application crashes, unauthorized data access, or the ability to bypass security checks.
Technical details
The _copyProps function in lib/src/object/copy.ts (used by objDeepCopy and objCopyProps) utilizes a for...in loop to iterate over source object properties without performing an Object.hasOwnProperty check. Furthermore, it fails to filter sensitive keys such as __proto__, constructor, and prototype. An attacker providing a specially crafted JSON object can trigger prototype pollution, allowing them to inject properties into the global Object.prototype. This vulnerability is reachable if the application passes untrusted user input to affected object utility functions. The issue is fixed in version 0.14.0 by implementing proper key filtering and ownership checks.
Affected products
- nevware21 ts-utils < 0.14.0
Timeline
- 2026-05-18: patched: Fix committed to repository
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE published to NVD