EUVD-2026-45394Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable merge function requires low-privilege configuration access; impact bounded to partial C/I/A within the vulnerable runtime with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Prototype pollution in RobinHerbots Inputmask up to version 5.0.9 allows low-privileged remote attackers to manipulate JavaScript's shared Object.prototype via the internal deep merge helper functions extendDefaults, extendDefinitions, and extendAliases in lib/dependencyLibs/extend.js. Successful exploitation enables injection of arbitrary properties onto the global prototype chain, potentially leading to information disclosure, logic bypass, or application state manipulation within any JavaScript runtime consuming the library with attacker-influenced configuration input. No vendor patch is available as the project has not responded to the responsible disclosure report filed via GitHub issue #2885; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
RobinHerbots Inputmask (CPE: cpe:2.3:a:robinherbots:inputmask:*:*:*:*:*:*:*:*) is a JavaScript library providing configurable input masking for web forms. The vulnerability resides in an internal utility at lib/dependencyLibs/extend.js, which performs deep object merging to apply user-supplied configuration via extendDefaults, extendDefinitions, and extendAliases. CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) - occurs when these merge operations fail to reject or sanitize reserved keys such as __proto__, constructor, or prototype before recursively assigning properties. Because JavaScript objects inherit from a shared prototype chain, successfully writing to Object.prototype affects every subsequently instantiated object in the runtime. While Inputmask is predominantly deployed as a client-side browser library, any server-side Node.js usage amplifies the blast radius, as server prototype pollution can affect the entire request-handling context.
RemediationAI
No vendor-released patch has been identified at time of analysis - the Inputmask project has not responded to the responsible disclosure documented at https://github.com/RobinHerbots/Inputmask/issues/2885 and https://vuldb.com/cve/CVE-2026-16150. As a primary compensating control, developers should sanitize all configuration objects passed to extendDefaults, extendDefinitions, and extendAliases by explicitly rejecting or stripping keys matching __proto__, constructor, and prototype before they reach the merge operation; this is an application-level control that does not require a library change. A more durable mitigation is to replace the internal extend.js deep merge utility with a prototype-pollution-safe alternative - for example, substituting the merge logic with Object.assign on shallow structures or using libraries explicitly hardened against CWE-1321. In Node.js deployments, consider freezing Object.prototype with Object.freeze(Object.prototype) at application startup as a defense-in-depth measure, though this may introduce compatibility trade-offs with other libraries relying on prototype augmentation. Monitor the upstream GitHub repository and VulDB entry for patch availability.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today