The vulnerability resides in the _copyProps function of @nevware21/ts-utils. The implementation uses a for…in loop over a source object without checking Object.hasOwnProperty, and it does not exclude dangerous keys such as __proto__, constructor, or prototype. When an attacker supplies an object containing these keys, the function copies them onto the target, effectively polluting the Object.prototype of every object in the environment. The result is a modification of the prototype chain that could lead to unintended behaviour in any part of the code that relies on default prototypes.

All instances of @nevware21/ts-utils earlier than version 0.14.0 are vulnerable. Projects that have not updated the package lock or have pinned an older version are at risk. The issue is fixed in 0.14.0 and later versions.

The CVSS score of 7.2 classifies the flaw as high severity. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV. Nevertheless, the flaw can be triggered by any code that calls objDeepCopy or objCopyProps with a crafted object. In a typical web or Node.js application, an attacker who can influence the input to these copy functions could affect global prototypes, potentially disrupting logic or allowing further attacks that rely on prototype tampering. Exploitation would most likely occur in environments where the library is exposed to untrusted data, such as user‑generated content or third‑party API payloads.