VDB
CVE-2026-15187
CVE-2026-15187
PUBLISHED
CVSS 5.3 MEDIUM
enquirer Public Package API Enquirer.set prototype pollution
Reported by vuldb · Published July 9, 2026
A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report.
Risk scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | enquirer | 2.4.0, 2.4.1 |
| n/a | enquirer | 2.4.0, 2.4.1 |
Timeline
- Jul 9, 2026 CVE Published
- Jul 9, 2026 CVE Updated
- Jul 10, 2026 Coalition ESS Score
- Aug 7, 2026 EPSS Score (24 in total, the first dated here)
- Aug 28, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-15187
vulnetix vdb fixes CVE-2026-15187Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-15187/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- VDB-377113 | enquirer Public Package API Enquirer.set prototype pollution vdb-entrytechnical-description
- VDB-377113 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
- CVE-2026-15187 | CVE Analysis and Report third-party-advisory
- Submit #851357 | Node.js enquirer 2.4.1 Prototype Pollution third-party-advisory
- issue-tracking
- exploitissue-tracking
- product