Description
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness has been identified in antv layout 2.0.0. The vulnerability is limited to the function setNestedValue in lib/util/object.js, where a crafted path argument can cause the function to modify JavaScript prototype attributes. This leads to prototype pollution, allowing an attacker to alter the behavior of objects globally across the application. The flaw can be triggered remotely by providing a malicious path argument through an external input surface.

Affected Systems

The issue affects the antv layout JavaScript library, version 2.0.0. No other versions or vendor products are listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA KEV, and no publicly available exploit or proof‑of‑concept has been reported at this time, indicating a limited likelihood of exploitation.

Generated by OpenCVE AI on July 31, 2026 at 11:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch or upgrade antv layout to a newer release that resolves the prototype pollution flaw.
  • Prior to calling setNestedValue, sanitize the path argument by rejecting keys that could influence the prototype chain, such as "__proto__" and "constructor".
  • If a patch or upgrade cannot be performed, replace or remove the vulnerable setNestedValue implementation with a secure alternative that enforces strict key validation.

Generated by OpenCVE AI on July 31, 2026 at 11:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Title antv layout object.js setNestedValue prototype pollution
First Time appeared Antv
Antv layout
Weaknesses CWE-1321
CWE-94
CPEs cpe:2.3:a:antv:layout:*:*:*:*:*:*:*:*
Vendors & Products Antv
Antv layout
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Antv Layout
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T13:01:23.090Z

Reserved: 2026-07-13T14:08:46.995Z

Link: CVE-2026-15598

cve-icon Vulnrichment

Updated: 2026-07-14T13:01:19.094Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:15:05Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')