CVE-2026-15538 Overview
CVE-2026-15538 is a prototype pollution vulnerability affecting PrimeFaces PrimeReact versions up to 10.9.8. The flaw resides in the ObjectUtils.mutateFieldData function within the component API. Attackers can manipulate the Field argument to trigger improperly controlled modification of object prototype attributes [CWE-94]. The vulnerability is exploitable remotely and requires low privileges.
The maintainers were notified through an issue report but have not responded. This vulnerability only affects product versions that are no longer supported by the maintainer, meaning no official patch is planned.
Critical Impact
Remote attackers with low privileges can pollute JavaScript object prototypes through the Field parameter, potentially leading to application logic tampering, denial of service, or downstream code execution in dependent components.
Affected Products
- PrimeFaces PrimeReact versions up to and including 10.9.8
- The vulnerable ObjectUtils.mutateFieldData API function
- Applications embedding unsupported PrimeReact releases in their frontend stack
Discovery Timeline
- 2026-07-13 - CVE-2026-15538 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-15538
Vulnerability Analysis
The vulnerability exists in ObjectUtils.mutateFieldData, a utility function used by PrimeReact components to mutate object fields based on a supplied Field argument. When the function traverses or assigns properties using a caller-controlled field path, it fails to filter reserved keys such as __proto__, constructor, or prototype.
An attacker who controls the Field value can walk into the base Object.prototype. Any property written there becomes visible to every JavaScript object in the runtime. This class of flaw is categorized as improperly controlled modification of object prototype attributes and maps to [CWE-94] Improper Control of Generation of Code.
Exploitation is network-based and requires only low privileges, with no user interaction. Because the maintainer has marked the affected versions end-of-life, applications running these releases will not receive a vendor fix.
Root Cause
The root cause is missing key sanitization inside ObjectUtils.mutateFieldData. The function accepts a dotted field path and recursively descends into a target object without validating segment names against a denylist. Segments such as __proto__.polluted therefore reach the underlying assignment logic and modify the shared prototype chain.
Attack Vector
An attacker submits a crafted Field value through any application surface that ultimately reaches ObjectUtils.mutateFieldData. Typical entry points include form submissions, JSON API bodies, or component props derived from user-controlled request data. Once the prototype is polluted, downstream logic reading properties on generic objects observes attacker-injected values, which can bypass authorization checks, alter conditional flows, or trigger gadget chains that lead to code execution.
See the GitHub Issue #8553 and VulDB entry for CVE-2026-15538 for additional technical context.
Detection Methods for CVE-2026-15538
Indicators of Compromise
- Request payloads containing __proto__, constructor.prototype, or prototype tokens in field name parameters
- Unexpected properties appearing on plain JavaScript objects at runtime, such as {}.polluted === true
- Frontend errors or altered behavior in PrimeReact components after processing untrusted input
- Application logs showing calls to ObjectUtils.mutateFieldData with dotted paths originating from user input
Detection Strategies
- Perform a software composition analysis scan to identify primereact versions at or below 10.9.8 in package.json and package-lock.json files
- Instrument the browser or Node.js runtime to detect writes to Object.prototype, for example by freezing the prototype with Object.freeze(Object.prototype) in non-production builds and observing thrown errors
- Deploy web application firewall rules that inspect JSON bodies and query strings for prototype pollution key patterns
- Review application telemetry for anomalous property access on shared objects following user input processing
Monitoring Recommendations
- Continuously monitor dependency manifests for vulnerable PrimeReact versions across all frontend repositories
- Log and alert on WAF matches for prototype pollution signatures on endpoints that feed data to PrimeReact components
- Track error rates and behavioral deltas in PrimeReact-heavy pages after deployments, which can reveal successful pollution attempts
How to Mitigate CVE-2026-15538
Immediate Actions Required
- Inventory all applications using PrimeReact and identify instances at version 10.9.8 or earlier
- Sanitize all user-controlled input paths that flow into ObjectUtils.mutateFieldData, rejecting segments equal to __proto__, constructor, or prototype
- Freeze Object.prototype at application startup using Object.freeze(Object.prototype) where compatibility allows
- Deploy WAF rules to block prototype pollution key patterns in inbound requests
Patch Information
No official patch is available. The maintainer has confirmed that affected versions are no longer supported and has not responded to the reported GitHub issue. Organizations should plan migration to a supported major release of PrimeReact or an alternative component library. Consult the PrimeReact repository for current supported versions.
Workarounds
- Wrap calls to ObjectUtils.mutateFieldData with a validator that rejects field paths containing reserved prototype keys
- Replace unsupported PrimeReact releases with a currently supported major version or an alternative UI library
- Convert plain-object data structures passed to PrimeReact components into Map instances or objects created with Object.create(null) to eliminate the prototype chain
- Apply strict input schemas using libraries such as zod or ajv to enforce allowed field names before they reach component APIs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
