CVE-2026-15598

MEDIUM

antv layout object.js setNestedValue prototype pollution

Title source: cna
STIX 2.1

Description

A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-378113 | antv layout object.js setNestedValue prototype pollution
https://vuldb.com/vuln/378113
Signature, Permissions Required signature permissions-required
VDB-378113 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/378113/cti
Third Party Advisory third-party-advisory
CVE-2026-15598 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15598
Third Party Advisory third-party-advisory
Submit #855637 | Node.js @antv/layout 2.0.0 Prototype Pollution
https://vuldb.com/submit/855637
Issue Tracking issue-tracking
https://github.com/antvis/layout/issues/292

Scores

CVSS v3 6.3
EPSS 0.0031
EPSS Percentile 23.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1321 CWE-94
Status published
Products (1)
antv/layout 2.0.0
Published Jul 13, 2026
Tracked Since Jul 14, 2026