CVE-2026-15538
Full vulnerability record from the local CVENow database.
Description
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component.
Severity
MEDIUM
CVSS score
5.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-13 07:16:28.813000
Last modified
2026-10-24 22:10:00.210000
View original CVE JSON
{
"id": "CVE-2026-15538",
"sourceIdentifier": "[email protected]",
"published": "2026-07-13T07:16:28.813",
"lastModified": "2026-10-24T22:10:00.210",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component."
},
{
"lang": "es",
"value": "Se ha identificado una debilidad en primefaces primereact hasta la versión 10.9.8. Este problema afecta a la función ObjectUtils.mutateFieldData del componente API. Esta manipulación del argumento Field causa una modificación indebidamente controlada de atributos de prototipo de objeto. El ataque puede llevarse a cabo de forma remota. El proyecto fue informado del problema con antelación a través de un informe de problema, pero aún no ha respondido. Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "primefaces",
"product": "primereact",
"cpes": [
"cpe:2.3:a:primefaces:primereact:*:*:*:*:*:*:*:*"
],
"modules": [
"API"
],
"versions": [
{
"version": "10.9.0",
"status": "affected"
},
{
"version": "10.9.1",
"status": "affected"
},
{
"version": "10.9.2",
"status": "affected"
},
{
"version": "10.9.3",
"status": "affected"
},
{
"version": "10.9.4",
"status": "affected"
},
{
"version": "10.9.5",
"status": "affected"
},
{
"version": "10.9.6",
"status": "affected"
},
{
"version": "10.9.7",
"status": "affected"
},
{
"version": "10.9.8",
"status": "affected"
},
{
"version": "10.9.9",
"status": "unaffected"
},
{
"version": "11.0.0",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-13T15:21:54.694785Z",
"id": "CVE-2026-15538",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
},
{
"lang": "en",
"value": "CWE-1321"
}
]
}
],
"references": [
{
"url": "https://github.com/Mantle-UI/mantle-ui/issues/50",
"source": "[email protected]"
},
{
"url": "https://github.com/primefaces/primereact/",
"source": "[email protected]"
},
{
"url": "https://github.com/primefaces/primereact/commit/61f182e11d9ef52032ff56f420da763a6938236f",
"source": "[email protected]"
},
{
"url": "https://github.com/primefaces/primereact/issues/8553",
"source": "[email protected]"
},
{
"url": "https://github.com/primefaces/primereact/releases/tag/10.9.9",
"source": "[email protected]"
},
{
"url": "https://github.com/primefaces/primereact/security/advisories/GHSA-hgqw-899r-rc46",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-15538",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/855024",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/377888",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/377888/cti",
"source": "[email protected]"
}
]
}