EUVD-2026-43725
GHSA-j7jf-w73f-7hjp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects mandatory authenticated low-privilege API access; S:U as prototype pollution is scoped to the vulnerable Node.js process with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation of the argument Set can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. Upgrading to version 7.2.2 will fix this issue. This patch is called fadc398251792c2ba441cbc539f359fc7943c0c2. It is recommended to upgrade the affected component.
AnalysisAI
Prototype pollution in kofrasa mingo up to version 7.2.1 allows low-privileged remote attackers to corrupt JavaScript Object.prototype by supplying __proto__ as a field selector in $set, updateOne, or updateMany operations, injecting arbitrary properties into all objects within the Node.js process. Proof-of-concept exploit code exists (CVSS 4.0 E:P), and successful exploitation can cascade to application-wide privilege logic bypass, information disclosure, or denial of service depending on how the host application relies on inherited object properties. Vendor-released patch version 7.2.2 is confirmed available.
Technical ContextAI
mingo is a JavaScript library that implements MongoDB's query and aggregation operators for in-memory processing of plain JavaScript objects in Node.js applications. CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) describes prototype pollution - a JavaScript-specific vulnerability class where attacker-controlled dot-notation paths traverse the prototype chain and write to Object.prototype instead of a target object. In mingo's Update API, the buildParams function in src/operators/update/_internal.ts accepted arbitrary field selectors without blocking the reserved __proto__ path segment, allowing inputs such as { "$set": { "__proto__.isAdmin": true } } to propagate through the resolve() utility and mutate Object.prototype globally. The commit diff confirms the fix: an assertNoProto guard was added to buildParams and resolve, rejecting selectors equal to or containing __proto__; additionally, a compile-time OBJECT_PROTO_PROPS set was introduced to prevent property resolution from accidentally accessing prototype-inherited keys. CPE cpe:2.3:a:kofrasa:mingo:*:*:*:*:*:*:*:* covers all versions up to and including 7.2.1.
RemediationAI
Upgrade mingo to version 7.2.2 or later, which is confirmed available at https://github.com/kofrasa/mingo/releases/tag/7.2.2 (patch commit fadc398251792c2ba441cbc539f359fc7943c0c2). If an immediate upgrade is not feasible, apply input sanitization at the application boundary before passing update payloads to mingo: reject any field selector string that equals __proto__, starts with __proto__., ends with .__proto__, or contains .__proto__.. This workaround must be applied at every call site that accepts external input for update operations; partial coverage leaves residual risk. Additionally, consider wrapping mingo update calls with Object.freeze(Object.prototype) in non-production validation environments to detect prototype mutation during integration testing, though this can break legitimate library code and is not suitable for production. The vendor advisory and issue tracker are at https://github.com/kofrasa/mingo/issues/606.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today