CVE-2026-15187

A flaw was found in enquirer, a command-line prompt tool. A remote attacker could exploit a vulnerability in the Enquirer.set function by manipulating the question.name argument. This improper handling of object prototype attributes can lead to prototype pollution, allowing an attacker to modify the behavior of an application. This could result in unexpected application behavior or potentially lead to further attacks.

This Moderate severity flaw in the enquirer command-line prompt tool allows a remote attacker to perform prototype pollution by manipulating the question.name argument within the Enquirer.set function. This could lead to unexpected application behavior in Red Hat products that use enquirer to process untrusted input, as an attacker could modify object attributes. The public availability of an exploit increases the risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.