CVE-2026-48819
Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params["query"]["__proto__"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.
Schwachstellenklasse
Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params["query"]["__proto__"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.
Quellen
- https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f
- https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169
- https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3
- https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw
- https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.