CVE-2026-15702: Tamagui Prototype Pollution Vulnerability

CVE-2026-15702 Overview

CVE-2026-15702 is a prototype pollution vulnerability affecting the Tamagui UI library up to version 2.3.0. The flaw resides in the updateConfig function within code/core/web/src/config.ts, which fails to validate keys before assigning values to configuration objects. An attacker with low privileges can manipulate the key parameter to modify object prototype attributes remotely. The issue is classified under CWE-94 (Improper Control of Generation of Code). Tamagui addressed the flaw in version 2.3.1 with commit e46af9879b7627934ea4d6d6e46e65cea53abb3d.

Critical Impact
Remote attackers can pollute JavaScript object prototypes through the updateConfig function, potentially altering application behavior across all Tamagui-based components.

Affected Products

Tamagui versions up to and including 2.3.0
Component: code/core/web/src/config.ts (updateConfig function)
Fixed in: Tamagui 2.3.1

Discovery Timeline

2026-07-14 - CVE-2026-15702 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15702

Vulnerability Analysis

The vulnerability stems from unsafe use of Object.assign inside the updateConfig function. The function accepts a key parameter and merges the provided value object into config[key] without validating whether the key belongs to the configuration object itself. Attackers can supply keys such as __proto__ or constructor to reach and modify Object.prototype. Any downstream code that reads properties from freshly created objects then inherits the polluted values. This can affect application logic, bypass security checks, or trigger unexpected behavior in components built on Tamagui.

Root Cause

The root cause is missing key validation before property assignment. The original implementation directly performed Object.assign(config![key], value) without confirming that key is an own property of config. This omission enables traversal into the prototype chain, satisfying the classic prototype pollution pattern tracked under CWE-94.

Attack Vector

Exploitation requires network access and low-level privileges but no user interaction. An attacker who can influence the key argument passed to updateConfig, such as through an application that forwards untrusted input into Tamagui configuration APIs, can inject prototype-altering keys. The impact is limited to confidentiality, integrity, and availability at low levels, consistent with typical prototype pollution behavior in front-end libraries.

typescript

 export const updateConfig = (key: string, value: any) => {
   // for usage internally only
   const config = getConfigFromGlobalOrLocal()
-  Object.assign(config![key], value)
+  if (!config || !Object.prototype.hasOwnProperty.call(config, key)) {
+    return
+  }
+  Object.assign(config[key], value)
 }

Source: Tamagui commit e46af98. The patch adds a hasOwnProperty guard that rejects keys not directly owned by the config object, blocking access to __proto__ and other inherited properties.

Detection Methods for CVE-2026-15702

Indicators of Compromise

Application logs showing unexpected property values on newly created JavaScript objects, particularly on properties never explicitly assigned.
Requests or client-side calls where the key argument to Tamagui's updateConfig contains strings such as __proto__, constructor, or prototype.
Anomalous UI rendering, configuration drift, or authorization decisions that trace back to polluted default values.

Detection Strategies

Perform a software composition analysis (SCA) scan of package.json and lockfiles to identify Tamagui installations at or below 2.3.0.
Instrument runtime checks around updateConfig call sites to log the key argument and flag values matching prototype-related identifiers.
Review application code paths that route user-controlled data into Tamagui configuration functions.

Monitoring Recommendations

Enable web application firewall (WAF) rules that inspect request bodies and query strings for __proto__, constructor.prototype, and similar tokens.
Track dependency updates through CI/CD pipelines and alert on builds pinning vulnerable Tamagui versions.
Monitor front-end error telemetry for unexpected type coercions or property access failures indicative of polluted prototypes.

How to Mitigate CVE-2026-15702

Immediate Actions Required

Upgrade Tamagui to version 2.3.1 or later across all projects and rebuild affected applications.
Audit application code for any invocation of updateConfig that accepts externally influenced keys and restrict inputs to an allowlist.
Rebuild and redeploy front-end bundles to ensure the patched library is delivered to end users.

Patch Information

The fix is delivered in Tamagui 2.3.1 via commit e46af9879b7627934ea4d6d6e46e65cea53abb3d. The patch introduces an Object.prototype.hasOwnProperty.call(config, key) check that rejects any key not directly owned by the configuration object. Release details are available in the Tamagui v2.3.1 release notes and the associated GitHub issue #4029.

Workarounds

If upgrading is not immediately possible, wrap updateConfig calls in a helper that validates keys against a static allowlist before invocation.
Freeze Object.prototype at application startup using Object.freeze(Object.prototype) to block runtime prototype modification.
Sanitize all user input to strip keys such as __proto__, constructor, and prototype before passing data to configuration functions.

bash

# Upgrade Tamagui to the patched version
npm install tamagui@2.3.1

# Verify installed version
npm ls tamagui

# Rebuild the application
npm run build