5.3 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): Low (L)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Exploit Maturity (E): Not Defined (X)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): Low (L)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
Activity log
- Created suggestion
antv layout object.js setNestedValue prototype pollution
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
References
-
VDB-378113 | antv layout object.js setNestedValue prototype pollution vdb-entrytechnical-description
-
-
CVE-2026-15598 | CVE Analysis and Report third-party-advisory
-
Submit #855637 | Node.js @antv/layout 2.0.0 Prototype Pollution third-party-advisory
-
https://github.com/antvis/layout/issues/292 issue-tracking
Affected products
- ==2.0.0
Matching in nixpkgs
pkgs.klayout
High performance layout viewer and editor with support for GDS and OASIS
pkgs.bsp-layout
Manage layouts in bspwm
-
nixos-unstable 2022-06-19
- nixpkgs-unstable 2022-06-19
- nixos-unstable-small 2022-06-19
-
nixos-26.05 2022-06-19
- nixos-26.05-small 2022-06-19
- nixpkgs-26.05-darwin 2022-06-19
pkgs.i3altlayout
Helps you handle more efficiently your screen real estate in i3wm by auto-splitting windows on their longest side
pkgs.wlr-layout-ui
Simple GUI to setup the screens layout on wlroots based systems
pkgs.i3-auto-layout
Automatic, optimal tiling for i3wm
-
nixos-unstable 2022-05-29
- nixpkgs-unstable 2022-05-29
- nixos-unstable-small 2022-05-29
-
nixos-26.05 2022-05-29
- nixos-26.05-small 2022-05-29
- nixpkgs-26.05-darwin 2022-05-29
pkgs.xlayoutdisplay
Detects and arranges linux display outputs, using XRandR for detection and xrandr for arrangement
pkgs.xkblayout-state
Small command-line program to get/set the current XKB keyboard layout
pkgs.river-bsp-layout
Binary space partition / grid layout manager for River WM
pkgs.i3-layout-manager
Saving, loading and managing layouts for i3wm
-
nixos-unstable 2020-05-04
- nixpkgs-unstable 2020-05-04
- nixos-unstable-small 2020-05-04
-
nixos-26.05 2020-05-04
- nixos-26.05-small 2020-05-04
- nixpkgs-26.05-darwin 2020-05-04
pkgs.keyboard-layout-editor
Keyboard layout editor for XKB
-
nixos-unstable 0-unstable-2019-05-14
- nixpkgs-unstable 0-unstable-2019-05-14
- nixos-unstable-small 0-unstable-2019-05-14
-
nixos-26.05 0-unstable-2019-05-14
- nixos-26.05-small 0-unstable-2019-05-14
- nixpkgs-26.05-darwin 0-unstable-2019-05-14
pkgs.pkgsRocm.wlr-layout-ui
Simple GUI to setup the screens layout on wlroots based systems
pkgs.haskellPackages.layoutz
Simple, beautiful CLI output
pkgs.perlPackages.TextLayout
Pango style markup formatting
pkgs.perl5Packages.TextLayout
Pango style markup formatting
pkgs.typstPackages.layout-ltd
None
pkgs.haskellPackages.doclayout
A prettyprinting library for laying out text documents
pkgs.python313Packages.klayout
KLayout’s Python API
pkgs.python314Packages.klayout
KLayout’s Python API
pkgs.haskellPackages.keylayouts
Tools for macOS .keylayout files
pkgs.haskellPackages.layoutz-hs
Simple, beautiful CLI output for Haskell
pkgs.hyprland-per-window-layout
Per window keyboard layout (language) for Hyprland wayland compositor
pkgs.haskellPackages.data-layout
Read/write arbitrary binary layouts to a "Data.Vector.Storable".
pkgs.gnomeExtensions.layout-fixer
Instantly corrects text typed in the wrong keyboard layout (EN/UA). Uses native GNOME APIs to transliterate and replace selected text via a customizable shortcut. Designed specifically for Wayland.
pkgs.haskellPackages.force-layout
Simple force-directed layout
pkgs.haskellPackages.table-layout
Format tabular data as grid or table
pkgs.typstPackages.diagraph-layout
None
pkgs.gnomeExtensions.layout-hotkeys
Add hotkeys to switch keyboard layout directly via Shift + Alt + [1-9].
pkgs.python313Packages.layoutparser
Unified toolkit for Deep Learning Based Document Image Analysis
pkgs.python314Packages.layoutparser
Unified toolkit for Deep Learning Based Document Image Analysis
pkgs.typstPackages.layout-ltd_0_1_0
None
pkgs.typstPackages.ostfriesen-layout
None
pkgs.haskellPackages.directory-layout
Directory layout DSL
pkgs.gnomeExtensions.switch-two-layouts
This extension makes XKB shortcuts to switch keyboard layouts (such as Caps Lock, Ctrl+Shift, etc.) cycle between the two first layouts. The other ones still can be selected via the menu or using GNOME's shortcuts (Super+Space, Shift+Super+Space). It's useful when you have two primary layouts and more additional, which are used more rarely.
pkgs.rubyPackages.jekyll-default-layout
None
pkgs.typstPackages.diagraph-layout_0_0_1
None
pkgs.gnomeExtensions.hide-keyboard-layout
Hide keyboard layout indicator in status bar
pkgs.gnomeExtensions.keyboard-layout-flags
Adds Unicode country flags next to layout names in the keyboard switcher (Super+Space)
pkgs.pkgsRocm.python3Packages.layoutparser
Unified toolkit for Deep Learning Based Document Image Analysis
pkgs.typstPackages.ostfriesen-layout_0_1_0
None
pkgs.haskellPackages.hslua-module-doclayout
Lua module wrapping Text.DocLayout.
pkgs.rubyPackages_3_3.jekyll-default-layout
None
pkgs.rubyPackages_3_4.jekyll-default-layout
None
pkgs.rubyPackages_4_0.jekyll-default-layout
None
pkgs.gnomeExtensions.keyboard-layouts-labels
Label your layouts to see in layout indicator
pkgs.gnomeExtensions.rx-input-layout-switcher
Use Alt+Shift to change the keyboard language
pkgs.haskellPackages.safe-coloured-text-layout
Safely layout output coloured text
Package maintainers
-
@totoroot Matthias Thym <git@thym.at>
-
@honnip Jung seungwoo <me@honnip.page>
-
@azazak123 Volodymyr Antonov <azazaka2002@gmail.com>
-
@perstarkse Per Stark <perstark.se@gmail.com>
-
@Mephistophiles Maxim Zhukov <mussitantesmortem@gmail.com>
-
@magnetophon Bart Brouns <bart@magnetophon.nl>
-
@FliegendeWurst Arne Keller <arne.keller@posteo.de>
-
@happysalada Raphael Megzari <raphael@megzari.com>
-
@bnlrnz Ben Lorenz <bnlrnz@gmail.com>
-
@fedeinthemix Federico Beffa <beffa@fbengineering.ch>
-
@areif-dev AJ Reifsnyder <aj@ajreifsnyder.com>
-
@stephen-huan Stephen Huan <stephen.huan@cgdct.moe>