EUVD-2026-338940

fkie_cve-2026-48819

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params["query"]["__proto__"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.

GHSA-hhx9-57xq-r5rw — @hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$_proto` key

Affected: npm: @hey-api/openapi-ts

### Summary

`dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `"$query___proto__"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`.

### Details

The vulnerable branch in `dist/clients/core/params.ts`:

```typescript const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix)) if (extra) { const [prefix, slot] = extra ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value } ```

This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `"$query___proto__"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith("$query_")` is true, and `key.slice(7)` produces `"__proto__"`. The bracket-write `params["query"]["__proto__"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`.

**Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the applic…

Most recent entries from all

EUVD-2026-338940

fkie_cve-2026-48819

GHSA-hhx9-57xq-r5rw — @hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$___proto__` key

GHSA-hhx9-57xq-r5rw — @hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$_proto` key