CVE-2026-45325 | Gestor de Oferta is a web application for managing mobility … | CVSS 8.2 HIGH

Description

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.

Metadata

CVE ID: CVE-2026-45325
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-11 20:50 UTC
Published: 2026-07-16 16:41 UTC
Last updated: 2026-07-17 18:06 UTC
Primary CWE: CWE-1321
CWE-1321: Improperly Controlled Modification of Object Proto…
Vendor / Product: tmlmobilidade / go
Sources: cve.org · NVD

Severity & Metrics

8.2 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
tmlmobilidade	go	—	< 20260509.0340.15

Weakness (CWE)

CWE	Source	Description
CWE-1321	cna	CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.2	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References (2)

https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94 https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94
https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7 https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7