CVE-2026-15187

MEDIUM

enquirer Public Package API Enquirer.set prototype pollution

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-377113 | enquirer Public Package API Enquirer.set prototype pollution
https://vuldb.com/vuln/377113
Signature, Permissions Required signature permissions-required
VDB-377113 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/377113/cti
Third Party Advisory third-party-advisory
CVE-2026-15187 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15187
Third Party Advisory third-party-advisory
Submit #851357 | Node.js enquirer 2.4.1 Prototype Pollution
https://vuldb.com/submit/851357
Issue Tracking issue-tracking
https://github.com/enquirer/enquirer/issues/487

Scores

CVSS v3 4.3
EPSS 0.0025
EPSS Percentile 16.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1321 CWE-94
Status published
Products (2)
None/enquirer 2.4.0
None/enquirer 2.4.1
Published Jul 09, 2026
Tracked Since Jul 09, 2026