Tamagui’s updateConfig function, located in the core configuration module, validates user‑supplied configuration data without sufficient checks. This allows a remote attacker to inject arbitrary properties into JavaScript object prototypes, resulting in unauthorized modification of prototype attributes. The prototype‑pollution flaw (CWE‑1321) can cause unpredictable application behavior and compromise data integrity, as the altered prototypes may affect subsequent code paths. The vulnerability is classified under CWE‑94 as well, reflecting the dynamic nature of the configuration handling.

Tamagui, a React Native and Web UI framework, is affected in all releases up to and including v2.3.0. The vendor fix is delivered in release v2.3.1 and corresponds to commit e46af9879b7627934ea4d6d6e46e65cea53abb3d. Administrators should upgrade to version 2.3.1 or later to resolve the vulnerability.

The CVSS score of 5.3 classifies this vulnerability as medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The description states that the attack may be performed from remote, indicating that the vulnerability can be exploited over the network by sending malicious configuration data to the vulnerable code path. Successful exploitation would require the attacker to deliver crafted configuration that reaches the updateConfig function, after which prototype pollution would occur, potentially leading to unpredictable behavior or compromised data integrity.