Medium [CVE-2026-15187] Prototype pollution vulnerability allows remote attackers to modify object attributes

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API.

The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely.

The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report.

A flaw was found in enquirer, a command-line prompt tool. A remote attacker could exploit a vulnerability in the `Enquirer.set` function by manipulating the `question.name` argument.

This improper handling of object prototype attributes can lead to prototype pollution, allowing an attacker to modify the behavior of an application. This could result in unexpected application behavior or potentially lead to further attacks.

This could lead to unexpected application behavior in Red Hat products that use `enquirer` to process untrusted input, as an attacker could modify object attributes. The public availability of an exploit increases the risk.

Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-915.

Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; Migration Toolkit for Containers; Multicluster Engine for Kubernetes; and 17 more.