EUVD-2026-46151
GHSA-c8xx-jpr5-7m25
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector applies as input reaches the library via web requests; AC:H because user input must reach expandKey() without prior sanitization; S:C because pollution escapes to the Node.js runtime prototype; no confidentiality or availability impact from prototype key injection alone.
Primary rating from Vendor (snyk).
CVSS VectorVendor: snyk
Lifecycle Timeline
4DescriptionCVE.org
Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__.
AnalysisAI
Prototype Pollution in the mongo-object npm package (versions before 3.0.3) allows network-reachable attackers to corrupt the JavaScript Object.prototype by supplying crafted property paths containing special keys such as __proto__, constructor, or prototype to the expandKey() function in util.ts. No authentication or user interaction is required, though high attack complexity reflects the need for attacker-controlled input to reach the vulnerable function. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data is not provided, and the CVSS base score of 4.0 (Medium) reflects a narrowly scoped integrity impact without confidentiality or availability consequences.
Technical ContextAI
mongo-object is a JavaScript/TypeScript utility library in the npm ecosystem (CPE: cpe:2.3:a:n/a:mongo-object:*:*:*:*:*:*:*:*) used primarily in the Meteor/SimpleSchema stack to translate MongoDB dot-notation query strings into nested object representations. The vulnerable function expandKey() in src/util.ts iterates over bracket-delimited key segments of a property path and assigns values to a target object without validating the segment names. CWE-1321 (Improper Control of Object Prototype Attributes) describes this root cause: by passing a path such as __proto__[polluted] or constructor[polluted], an attacker can cause JavaScript's prototype chain assignment mechanics to modify Object.prototype itself rather than a user-defined property. Because Object.prototype is shared across all objects in the same runtime context, a single successful pollution can silently alter the behavior of any code in the process that reads inherited properties. The fix, visible in commit 638314107d8b397e5453c28e41729522b3e8d67c, introduces an early-return blocklist guard in expandKey() rejecting any subkey equal to __proto__, constructor, or prototype.
RemediationAI
The primary remediation is to upgrade mongo-object to version 3.0.3 or later, which includes the blocklist fix in expandKey() blocking __proto__, constructor, and prototype segment names. The patched commit is 638314107d8b397e5453c28e41729522b3e8d67c (https://github.com/longshotlabs/mongo-object/commit/638314107d8b397e5453c28e41729522b3e8d67c). Run npm update mongo-object or set the version constraint to >=3.0.3 in package.json and reinstall. If an immediate upgrade is blocked, a compensating control is to sanitize any user-supplied property path strings before passing them to expandKey(), rejecting or stripping segments that match __proto__, constructor, or prototype-note this places the validation burden on the consuming application and is error-prone. Alternatively, Object.freeze(Object.prototype) at application startup can prevent prototype modification at runtime, though this may break libraries that legitimately add prototype methods. Neither workaround is as reliable as patching. Snyk advisory: https://security.snyk.io/vuln/SNYK-JS-MONGOOBJECT-13816714.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today