GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

影響: npm:@graphql-tools/utils >= 10.10.1, <= 12.0.1 → 12.0.2

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils (npm, pkg:github/ardatan/graphql-tools) | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath (packages/utils/src/mergeIncrementalResult.ts) | | Vulnerability class | Prototype pollution (via unvalidated object path traversal) | | Verified against | Source read at 134d67ae36a559651f43ec7fe4a9da76f4a00c2b; master HEAD ccca0ff0dc8ea20726fd116b2f19a38709c30…

GitHub Advisory Databaseで読む

2026/10/23 01:28、GitHub Advisory Databaseが「GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js、GitHub。CVE: CVE-2026-114604。