EUVD-2026-45397Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authentication required (PR:L) per CVSS 4.0 alignment; scope unchanged as pollution confined to single application process; limited and equal C/I/A impacts reflect prototype pollution's constrained but real effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the argument column leads to improperly controlled modification of object prototype attributes. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Prototype pollution in CartoDB carto-api-client 0.5.29 exposes applications to object prototype manipulation via the column argument of the addFilter function in src/filters.ts. Authenticated remote attackers can inject arbitrary properties into the JavaScript Object prototype, affecting all runtime objects in the application and enabling limited confidentiality, integrity, and availability impacts as reflected by the CVSS 4.0 score of 5.3. No patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue #299 - and no active exploitation or public exploit code has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the addFilter function within the TypeScript source file src/filters.ts of the carto-api-client JavaScript library, version 0.5.29 (CPE: cpe:2.3:a:cartodb:carto-api-client:*:*:*:*:*:*:*:*). CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) describes prototype pollution, a class of JavaScript vulnerability where attacker-controlled input is used as a property key on an object without sanitizing prototype-polluting payloads such as __proto__, constructor, or prototype. When the column argument is passed unsanitized into object property assignment logic, an attacker can overwrite properties on Object.prototype, causing those properties to appear on every subsequently created plain object in the runtime. In Node.js server-side deployments, this can interact with downstream gadget chains to escalate impact beyond the base CVSS metrics suggest; in browser-only deployments, impact is limited to the client session.
RemediationAI
No vendor-released patch has been identified at time of analysis, as the CartoDB project has not responded to the responsible disclosure. Developers should immediately validate and sanitize the column argument in all calls to addFilter (src/filters.ts) to reject or strip prototype-polluting keys including __proto__, constructor, and prototype prior to any object property assignment. An alternative runtime hardening measure is applying Object.freeze(Object.prototype) at application startup, though this carries a trade-off of breaking any third-party libraries that perform legitimate prototype extension. Restricting invocation of the affected filter API surface to fully trusted, authenticated users reduces exposure in line with the PR:L CVSS metric. Developers should monitor the GitHub issue tracker at https://github.com/CartoDB/carto-api-client/issues/299 and the VulDB entry at https://vuldb.com/cve/CVE-2026-16151 for patch availability and vendor response.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today