CVE-2026-15538

primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

State: Published
Severity: 5.3 Medium
Published: Jul 13, 2026
Updated: Aug 27, 2026
Reserved: Jul 12, 2026

Description

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
CWE-94 Code Injection

Affected Products

Product	Versions
primereactprimefaces	10.9.0Affected 10.9.1Affected 10.9.2Affected 10.9.3Affected 10.9.4Affected 10.9.5Affected 10.9.6Affected 10.9.7Affected 10.9.8Affected 10.9.9Not affected 11.0.0Not affected

References

VDB-377888 | primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollutionvdb-entrytechnical-description
VDB-377888 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-15538 | CVE Analysis and Reportthird-party-advisory
Submit #855024 | Node.js primereact 10.9.8 Prototype Pollutionthird-party-advisory
https://github.com/primefaces/primereact/issues/8553issue-tracking
https://github.com/primefaces/primereact/security/advisories/GHSA-hgqw-899r-rc46related
https://github.com/primefaces/primereact/commit/61f182e11d9ef52032ff56f420da763a6938236fpatch
https://github.com/primefaces/primereact/releases/tag/10.9.9patch
https://github.com/Mantle-UI/mantle-ui/issues/50issue-tracking
https://github.com/primefaces/primereact/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.