apidevtools CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW apidevtools CVE published 2026-07-09

CVE-2026-15195

A weakness in apidevtools json-schema-ref-parser impacts the function Refs.set/Pointer.set in lib/pointer.ts, allowing improper control of object prototype attributes. Upgrading to version 15.3.6 fixes this issue. The project maintainer confirms reproducing prototype pollution through the public $Refs.set() API in published versions 7.1.4, 9.0.0, 11.0.0, 14.0.0, 14.2.1, 15.3.0, and 15.3.5. This issue requ [truncated]