{"id":"ghsa-ghsa-c4qx-w738-7hr3","seq":309572,"kind":"advisory","title":"GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments","url":"https://github.com/advisories/GHSA-c4qx-w738-7hr3","permalink":"https://vulnpulse.app/items/ghsa-ghsa-c4qx-w738-7hr3","summary":"影響: npm:@graphql-tools/utils >= 10.10.1, <= 12.0.1 → 12.0.2\nReport metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils (npm, pkg:github/ardatan/graphql-tools) | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath (packages/utils/src/mergeIncrementalResult.ts) | | Vulnerability class | Prototype pollution (via unvalidated object path traversal) | | Verified against | Source read at 134d67ae36a559651f43ec7fe4a9da76f4a00c2b; master HEAD ccca0ff0dc8ea20726fd116b2f19a38709c30…","severity":"high","techs":["nodejs","github"],"cves":["CVE-2026-114604"],"tags":["GHSA-c4qx-w738-7hr3","@graphql-tools/utils"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:28:31.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}