Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-15538— primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

Quick assessment

Affected

primefaces primereact

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Primetek primefaces是Primetek公司开源的一款JavaServerFaces组件库。 Primetek primefaces存在安全漏洞，该漏洞源于API组件中ObjectUtils.mutateFieldData函数对参数Field的操作导致对象原型属性控制不当，可能导致远程攻击。

CVSS 6.3 · Medium EPSS 0.54% · P45 Updated Aug 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 11

Vendor	Product	Version Range	Status
primefaces	primereact	`10.9.0`	affected
		`10.9.1`	affected
		`10.9.2`	affected
		`10.9.3`	affected
		`10.9.4`	affected
		`10.9.5`	affected
		`10.9.6`	affected
		`10.9.7`	affected
… +3 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15538

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

Source: CVE Program / CVE List V5

Vulnerability Description

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1321

Source: CVE Program / CVE List V5

Vulnerability Title

Primetek primefaces 输入验证错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
primefaces	primereact	10.9.0	`cpe:2.3:a:primefaces:primereact::::::::`

II. Public POCs for CVE-2026-15538

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-15538

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-15538 (1)

🔗 fix(#8553): Prototype pollution in ObjectUtils.mutateFieldData via pr… · primefaces/primereact@61f182e · GitHub Read full article patch

Vendor Advisories for CVE-2026-15538 (2)

News Coverage for CVE-2026-15538 (1)

🔗 Prototype pollution in ObjectUtils.mutateFieldData via primereact/utils · Issue #50 · Mantle-UI/mantle-ui Read full article issue-tracking

Vendor Pages for CVE-2026-15538 (2)

https://www.cve.org/CVERecord?id=CVE-2026-15538

IV. Related Vulnerabilities

Same weakness: CWE-1321