Nixpkgs security tracker

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-45325

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

created 5 days, 23 hours ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 5 days, 23 hours ago

Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.

References

https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94 x_refsource_CONFIRM
https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7 x_refsource_MISC

Affected products

==< 20260509.0340.15

Suggestion detail

References

Affected products