GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

影響: npm:@graphql-tools/utils >= 10.10.1, <= 12.0.1 → 12.0.2

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils (npm, pkg:github/ardatan/graphql-tools) | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath (packages/utils/src/mergeIncrementalResult.ts) | | Vulnerability class | Prototype pollution (via unvalidated object path traversal) | | Verified against | Source read at 134d67ae36a559651f43ec7fe4a9da76f4a00c2b; master HEAD ccca0ff0dc8ea20726fd116b2f19a38709c30…

在 GitHub Advisory Database 阅读

2026/10/23 01:28，GitHub Advisory Database 发布了“GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js、GitHub。CVE：CVE-2026-114604。