Description
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-07-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the ObjectUtils.mutateFieldData function of primefaces primereact. A crafted Field argument can cause improper modification of JavaScript object prototype attributes, leading to prototype pollution. The CVE notes that this attack is possible remotely, but no confirmed exploitation is documented. The weakness maps to CWE-1321, CWE-915, and CWE-94.

Affected Systems

This weakness affects primefaces primereact versions up to and including 10.9.8. Any deployment that uses a release within that range and that is no longer supported by the maintainer is potentially exposed.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector is remote, but no active exploit has been publicly described.

Generated by OpenCVE AI on July 31, 2026 at 12:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a supported primefaces primereact release beyond 10.9.8 that removes or protects the ObjectUtils.mutateFieldData functionality.
  • Refactor application code to eliminate or strictly validate calls to ObjectUtils.mutateFieldData, ensuring only safe, pre‑validated objects are passed.
  • Implement runtime safeguards such as Content Security Policy and server‑side input verification to mitigate the effects of prototype pollution.

Generated by OpenCVE AI on July 31, 2026 at 12:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-915
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
Title primefaces primereact API ObjectUtils.mutateFieldData prototype pollution
First Time appeared Primefaces
Primefaces primereact
Weaknesses CWE-1321
CWE-94
CPEs cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*
Vendors & Products Primefaces
Primefaces primereact
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Primefaces Primereact
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-13T15:22:07.104Z

Reserved: 2026-07-12T18:03:07.553Z

Link: CVE-2026-15538

cve-icon Vulnrichment

Updated: 2026-07-13T15:22:00.667Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-13T06:00:11Z

Links: CVE-2026-15538 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T12:30:16Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')