CVE-2026-15538

MEDIUM 6.3

primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component.

CWE	CWE-1321 CWE-94
Vendor	primefaces
Product	primereact
Published	Jul 13, 2026
Last Updated	Aug 27, 2026

Stay Ahead of the Next One

Get instant alerts for primefaces primereact

Be the first to know when new medium vulnerabilities affecting primefaces primereact are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

primefaces / primereact

10.9.0 10.9.1 10.9.2 10.9.3 10.9.4 10.9.5 10.9.6 10.9.7 10.9.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/377888 vuldb.com: https://vuldb.com/vuln/377888/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15538 vuldb.com: https://vuldb.com/submit/855024 github.com: https://github.com/primefaces/primereact/issues/8553 github.com: https://github.com/primefaces/primereact/security/advisories/GHSA-hgqw-899r-rc46 github.com: https://github.com/primefaces/primereact/commit/61f182e11d9ef52032ff56f420da763a6938236f github.com: https://github.com/primefaces/primereact/releases/tag/10.9.9 github.com: https://github.com/Mantle-UI/mantle-ui/issues/50 github.com: https://github.com/primefaces/primereact/

Credits

🔍 Dremig (VulDB User) Mert Sincan (VulDB User)