Prototype Pollution in Tamagui Framework

Executive Summary

CVE-2026-15702 is a security vulnerability in the Tamagui library, specifically affecting versions up to 2.3.0. The issue occurs in the `updateConfig` function located in the file `code/core/web/src/config.ts`.

The vulnerability involves improperly controlled modification of object prototype attributes, commonly known as prototype pollution. An attacker can exploit this by manipulating the `updateConfig` function to inject malicious properties into the JavaScript object prototype.

The function accepts an arbitrary key and uses it to select a merge target via `Object.assign(config[key], value)`. If the key is `__proto__`, it can modify `Object.prototype` if the config object lacks its own `__proto__` property. This allows attackers to pollute the prototype, potentially affecting inherited properties, defaults, or feature flags in the application.

The vulnerability can be exploited remotely, and the recommended mitigation is to upgrade to Tamagui version 2.3.1, which includes a patch to address this issue.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if your system is using a vulnerable version of the Tamagui library (versions up to 2.3.0) and inspecting the code for the unsafe use of the `updateConfig` function.

• Check the installed version of Tamagui in your project. Run `npm list @tamagui/web` or `yarn list @tamagui/web` to verify the version. If the version is between 2.2.0 and 2.3.0, your system is vulnerable.
• Search your codebase for the `updateConfig` function call. Use a command like `grep -r "updateConfig" --include="*.js" --include="*.ts" /path/to/project` to locate its usage.
• Inspect the arguments passed to `updateConfig` to ensure they are not derived from untrusted input (e.g., user input, API responses, or dynamic theming plugins).
• Use static analysis tools or security scanners that detect prototype pollution vulnerabilities. Tools like `eslint-plugin-security` or `snyk` may flag unsafe property assignments.

If you find the `updateConfig` function being used with dynamic or untrusted keys, your system may be at risk.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of Tamagui (up to 2.3.0) in your application:

• Prototype pollution can lead to arbitrary code execution or denial of service by injecting malicious properties into the JavaScript object prototype. This can disrupt the normal functioning of your application.
• If your application relies on dynamic theming, plugins, or untrusted input for config updates, an attacker could exploit this vulnerability to manipulate inherited properties, defaults, or feature flags. This could result in unexpected behavior or security bypasses.
• The vulnerability can be exploited remotely, meaning an attacker does not need physical or local access to your system to carry out an attack. This increases the risk of widespread exploitation.
• Applications that share code between web and native platforms (e.g., React and React Native) may be particularly affected, as the vulnerability resides in a core component of Tamagui used across these platforms.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have implications for compliance with common standards and regulations, depending on how Tamagui is used in your application:

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access or manipulation of user data, it could result in a data breach. Under GDPR, organizations must protect personal data from unauthorized access or alteration. Failure to mitigate this vulnerability could lead to non-compliance, resulting in fines or legal action.
• HIPAA (Health Insurance Portability and Accountability Act): For applications handling protected health information (PHI), this vulnerability could compromise the integrity or confidentiality of patient data. HIPAA requires safeguards to protect PHI, and exploitation of this vulnerability could violate these requirements.
• Other standards like ISO 27001 or SOC 2: These frameworks require organizations to implement security controls to protect systems and data. A vulnerability like prototype pollution could indicate a failure to implement adequate security measures, potentially leading to non-compliance during audits.

To maintain compliance, it is critical to apply the patch (upgrade to Tamagui 2.3.1) and ensure that your application is not exposed to untrusted input that could exploit this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these steps:

• Upgrade Tamagui to version 2.3.1 or later. Run `npm install @tamagui/[email protected]` or `yarn upgrade @tamagui/[email protected]` to apply the patch.
• If upgrading is not immediately possible, apply the patch manually by modifying the `updateConfig` function in `code/core/web/src/config.ts`. Ensure the function checks if the key exists in the config object before assignment, as shown in the fix commit (e46af9879b7627934ea4d6d6e46e65cea53abb3d).
• Validate all inputs passed to `updateConfig` to ensure they do not contain dangerous keys like `__proto__`, `prototype`, or `constructor`. Use an allowlist of valid config sections to restrict key values.
• Audit your codebase for other instances of dynamic property assignments or merges that could lead to prototype pollution. Replace unsafe patterns with safer alternatives, such as using `Object.create(null)` to avoid inherited properties.
• Monitor your application for unusual behavior, such as unexpected property additions or changes to default object prototypes, which may indicate exploitation attempts.

Useful 0 Not Useful 0