CVE-2026-48819

### Summary `dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `"$query___proto__"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`. ### Details The vulnerable branch in `dist/clients/core/params.ts`: ```typescript const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix)) if (extra) { const [prefix, slot] = extra ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value } ``` This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `"$query___proto__"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith("$query_")` is true, and `key.slice(7)` produces `"__proto__"`. The bracket-write `params["query"]["__proto__"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`. **Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include `"$query___proto__"` alongside a legitimate field (e.g. `"q"`). The legitimate field ensures `stripEmptySlots` does not remove the affected slot (it has at least one own key), so the poisoned `params.query` object is returned to the caller. Concrete field config that hey-api generates for a GET endpoint with one query param `q`: