CVE-2026-15598 Overview
CVE-2026-15598 is a prototype pollution vulnerability affecting AntV Layout version 2.0.0, a JavaScript graph layout library maintained by AntVis. The flaw resides in the setNestedValue function within lib/util/object.js. Attackers can manipulate the path argument to trigger improperly controlled modification of object prototype attributes, classified under [CWE-94] Improper Control of Generation of Code. The issue was reported to the project through a public GitHub issue, but the maintainers have not yet responded. Because the vulnerable function accepts attacker-controlled input over a network boundary, exploitation does not require local access to the host running the library.
Critical Impact
Remote attackers with low privileges can pollute JavaScript object prototypes through the setNestedValue function, potentially altering application behavior across any code that consumes the affected library.
Affected Products
- AntV Layout 2.0.0 (@antv/layout)
- The setNestedValue function in lib/util/object.js
- Downstream applications and visualizations built on top of AntV Layout 2.0.0
Discovery Timeline
- 2026-07-13 - CVE-2026-15598 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-15598
Vulnerability Analysis
The vulnerability originates in the setNestedValue utility function inside lib/util/object.js. This helper is designed to assign a value to a nested property within an object by walking a dot-delimited or array-based path argument. When the function traverses the path without filtering reserved property names, an attacker can supply a path that references __proto__, constructor, or prototype. The assignment then propagates to Object.prototype, affecting every object created within the same JavaScript runtime.
Property pollution against Object.prototype can manipulate application logic, tamper with configuration objects, or bypass validation checks that depend on default property values. In server-side rendering pipelines or Node.js processing of untrusted graph data, the impact extends beyond the layout library itself.
Root Cause
The root cause is missing key validation in the recursive property assignment logic. The function does not blocklist dangerous keys such as __proto__, constructor.prototype, or prototype before descending into the target object. Any input that reaches setNestedValue with a controlled path becomes a prototype pollution primitive.
Attack Vector
Exploitation requires network-reachable code paths that pass user-controlled data into setNestedValue. Applications that accept JSON graph definitions, layout configuration objects, or query parameters and forward them to AntV Layout are candidates. An attacker submits a crafted payload where the path argument traverses __proto__ and assigns an attacker-chosen value. Refer to GitHub Issue #292 and VulDB CVE-2026-15598 for the original technical report. No verified proof-of-concept code has been released; the vulnerability mechanism is described here in prose without synthetic exploit code.
Detection Methods for CVE-2026-15598
Indicators of Compromise
- Request payloads or JSON bodies containing the strings __proto__, constructor.prototype, or prototype in property paths
- Unexpected properties appearing on baseline JavaScript objects at runtime, such as new keys on empty object literals
- Application errors or behavioral changes that correlate with graph rendering or layout computation requests
Detection Strategies
- Perform Software Composition Analysis (SCA) to enumerate direct and transitive dependencies on @antv/layout version 2.0.0
- Add runtime checks that freeze Object.prototype with Object.freeze(Object.prototype) in non-production environments to surface pollution attempts as thrown exceptions
- Inspect HTTP request bodies at the web application firewall or reverse proxy for reserved property names within nested JSON structures
Monitoring Recommendations
- Log calls to layout utility functions that receive external input, including the resolved path argument
- Alert on Node.js process exceptions referencing Object.prototype mutation or unexpected inherited properties
- Track dependency manifest changes in CI pipelines to detect installations of the affected 2.0.0 release
How to Mitigate CVE-2026-15598
Immediate Actions Required
- Inventory all applications and build artifacts that include @antv/layout 2.0.0 as a direct or transitive dependency
- Restrict or sanitize any user-controlled data that reaches AntV Layout configuration objects, rejecting paths that contain __proto__, constructor, or prototype
- Isolate affected services behind input validation layers until an upstream fix is available
Patch Information
At the time of publication, the AntV Layout project has not responded to the vulnerability report or released a patched version. Track GitHub Issue #292 for maintainer updates and the VulDB entry for downstream advisories.
Workarounds
- Pin dependencies to a version of @antv/layout prior to 2.0.0 if a non-vulnerable release is available in your environment, after validating compatibility
- Wrap calls into AntV Layout with a validation layer that rejects any path argument containing reserved prototype keys
- Apply Object.freeze(Object.prototype) during Node.js process initialization to prevent successful pollution of the base prototype
- Use a JSON schema validator on inbound graph or layout payloads to constrain the allowed key names and structure
# Configuration example
# Validate dependency tree for the affected library
npm ls @antv/layout
# Enforce prototype hardening at Node.js startup
node -e "Object.freeze(Object.prototype); require('./server.js')"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
