CVE-2026-15538 - Vulnerability Details

- primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

Description

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component.

Published: 2026-07-13

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in primereact’s ObjectUtils.mutateFieldData function. When a malformed Field object is passed, the function modifies JavaScript prototype properties without proper validation. This prototype pollution could lead to unintended behavior and corruption of objects that share the prototype chain. The weakness is classified as CWE‑1321, CWE‑915, and CWE‑94 because it involves unchecked modification of object prototypes and the use of dynamic property keys.

Affected Systems

This vulnerability affects the primefaces primereact library up to and including version 10.9.8. Any deployment that uses a release within that range is exposed until the library is upgraded to 10.9.9 or later, such as 11.0.0.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of <1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. Attack is reported to be possible remotely, as stated in the description. The flaw permits an attacker to supply a crafted Field object that modifies prototype properties, potentially affecting other objects that share the prototype chain. No public exploit is documented in the provided references. While prototype pollution can be leveraged in combination with other vulnerabilities to cause compromise or data integrity issues, the exact impact depends on the application’s usage of the affected library.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

primefaces

primereact

affected

Version	Status	Constraints
`10.9.0`	affected	—
`10.9.1`	affected	—
`10.9.2`	affected	—
`10.9.3`	affected	—
`10.9.4`	affected	—
`10.9.5`	affected	—
`10.9.6`	affected	—
`10.9.7`	affected	—
`10.9.8`	affected	—
`10.9.9`	unaffected	—
`11.0.0`	unaffected	—

No data.

Vendor Product Confidence Versions

Primefaces

Primereact

100%

Version	Status	Scheme	Platform
`10.9.0`	affected	semver	—
`10.9.1`	affected	semver	—
`10.9.2`	affected	semver	—
`10.9.3`	affected	semver	—
`10.9.4`	affected	semver	—
`10.9.5`	affected	semver	—
`10.9.6`	affected	semver	—
`10.9.7`	affected	semver	—
`10.9.8`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade primefaces primereact to version 10.9.9 or later, which removes the vulnerable ObjectUtils.mutateFieldData functionality.
If an upgrade cannot be performed immediately, validate or whitelist the Field input in application code to ensure that no prototype properties can be passed to ObjectUtils.mutateFieldData, or refactor the code to eliminate its use.
Add runtime safeguards such as enforcing a Content Security Policy and performing strict server‑side input validation to reduce the impact of any potential prototype pollution attempts.

Generated by OpenCVE AI on August 28, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00536.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Mantle-UI/mantle-ui/issues/50
https://github.com/primefaces/primereact/
https://github.com/primefaces/primereact/commit/61f182e11d9ef52032ff56f420da763a6938236f
https://github.com/primefaces/primereact/issues/8553
https://github.com/primefaces/primereact/releases/tag/10.9.9
https://github.com/primefaces/primereact/security/advisories/GHSA-hgqw-899r-rc46
https://nvd.nist.gov/vuln/detail/CVE-2026-15538
https://vuldb.com/cve/CVE-2026-15538
https://vuldb.com/submit/855024
https://vuldb.com/vuln/377888
https://vuldb.com/vuln/377888/cti
https://www.cve.org/CVERecord?id=CVE-2026-15538

History

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Description	A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.	A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component.
Title	primefaces primereact API ObjectUtils.mutateFieldData prototype pollution	primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution
References		https://github.com/primefaces/primereact/commit/61f182e11d9ef52032ff56f420da763a6938236f https://github.com/primefaces/primereact/releases/tag/10.9.9 https://github.com/primefaces/primereact/security/advisories/GHSA-hgqw-899r-rc46
Metrics	cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}`	cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}`

Tue, 14 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-915
References		https://nvd.nist.gov/vuln/detail/CVE-2026-15538 https://www.cve.org/CVERecord?id=CVE-2026-15538
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 13 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 13 Jul 2026 06:30:00 +0000

Type	Values Removed	Values Added
Description		A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
Title		primefaces primereact API ObjectUtils.mutateFieldData prototype pollution
First Time appeared		Primefaces Primefaces primereact
Weaknesses		CWE-1321 CWE-94
CPEs		cpe:2.3:a:primefaces:primereact::::::::
Vendors & Products		Primefaces Primefaces primereact
References		https://github.com/Mantle-UI/mantle-ui/issues/50 https://github.com/primefaces/primereact/ https://github.com/primefaces/primereact/issues/8553 https://vuldb.com/cve/CVE-2026-15538 https://vuldb.com/submit/855024 https://vuldb.com/vuln/377888 https://vuldb.com/vuln/377888/cti
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

Primefaces Primereact

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-07-13T06:00:11.115Z

Updated: 2026-08-27T20:01:03.803Z

Reserved: 2026-07-12T18:03:07.553Z

Link: CVE-2026-15538

Vulnrichment

Updated: 2026-07-13T15:22:00.667Z

NVD

Status : Deferred

Published: 2026-07-13T07:16:28.813

Modified: 2026-08-27T20:17:02.900

Link: CVE-2026-15538

Redhat

Severity : Moderate

Publid Date: 2026-07-13T06:00:11Z

Links: CVE-2026-15538 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T21:00:04Z

Weaknesses

CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-94
Improper Control of Generation of Code ('Code Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object