CVE-2026-45325

8.2 Élevée

Publiée le 16/07/2026 à 19:16 · Modifiée le 17/07/2026 à 21:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.

Traduire en français

Produits concernés

tmlmobilidade go

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.2 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L`

Faiblesses (CWE)

CWE-1321

Références

https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7
https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories