CVE-2026-15598

MEDIUM 6.3

antv layout object.js setNestedValue prototype pollution

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-1321 CWE-94
Vendor	antv
Product	layout
Published	Jul 13, 2026
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for antv layout

Be the first to know when new medium vulnerabilities affecting antv layout are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

antv / layout

2.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/378113 vuldb.com: https://vuldb.com/vuln/378113/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15598 vuldb.com: https://vuldb.com/submit/855637 github.com: https://github.com/antvis/layout/issues/292

Credits

🔍 Dremig (VulDB User) VulDB CNA Team