Description
A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report.
Published: 2026-07-09
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Enquirer.set function of the Enquirer library, affecting all releases up to 2.4.1. A remote attacker can supply a crafted value in the question.name argument that causes the library to modify object prototype attributes, resulting in prototype pollution. This flaw is related to improperly controlled modification of JavaScript object prototypes, as indicated by the associated weaknesses.

Affected Systems

Any project that includes the Enquirer library up to version 2.4.1 and calls Enquirer.set with supplier-provided data is potentially affected. The flaw is present in the public package API exposed by the library, regardless of the specific application type or runtime environment.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploit code has been publicly released, enabling attackers to target exposed applications by invoking the Enquirer.set API with malicious question.name payloads.

Generated by OpenCVE AI on July 29, 2026 at 12:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a newer Enquirer release that resolves the prototype pollution bug if one is available.
  • Sanitize or validate the question.name value before it is passed to Enquirer.set to prevent prototype modification.
  • Restrict access to the Enquirer.set API, ensuring that only trusted, internal code paths invoke it and that no untrusted input is processed through this interface.

Generated by OpenCVE AI on July 29, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-915
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 09 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report.
Title enquirer Public Package API Enquirer.set prototype pollution
First Time appeared Enquirer
Enquirer enquirer
Weaknesses CWE-1321
CWE-94
CPEs cpe:2.3:a:enquirer:enquirer:*:*:*:*:*:*:*:*
Vendors & Products Enquirer
Enquirer enquirer
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Enquirer Enquirer
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-09T16:07:24.338Z

Reserved: 2026-07-09T05:14:13.888Z

Link: CVE-2026-15187

cve-icon Vulnrichment

Updated: 2026-07-09T16:07:21.919Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-09T14:30:09Z

Links: CVE-2026-15187 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T12:30:03Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')