CVE-2026-15538
primefaces primereact API ObjectUtils.mutateFieldData prototype pollution
CVSS Score
6.3
EPSS Score
0.3%
EPSS Percentile
17th
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
| CWE | CWE-1321 CWE-94 |
| Vendor | primefaces |
| Product | primereact |
| Published | Jul 13, 2026 |
| Last Updated | Jul 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for primefaces primereact
Be the first to know when new medium vulnerabilities affecting primefaces primereact are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
primefaces / primereact
10.9.0 10.9.1 10.9.2 10.9.3 10.9.4 10.9.5 10.9.6 10.9.7 10.9.8
References
vuldb.com: https://vuldb.com/vuln/377888 vuldb.com: https://vuldb.com/vuln/377888/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15538 vuldb.com: https://vuldb.com/submit/855024 github.com: https://github.com/primefaces/primereact/issues/8553 github.com: https://github.com/Mantle-UI/mantle-ui/issues/50 github.com: https://github.com/primefaces/primereact/
Credits
🔍 Dremig (VulDB User) VulDB CNA Team