Mongo Object
Monthly
Prototype Pollution in the mongo-object npm package (versions before 3.0.3) allows network-reachable attackers to corrupt the JavaScript Object.prototype by supplying crafted property paths containing special keys such as __proto__, constructor, or prototype to the expandKey() function in util.ts. No authentication or user interaction is required, though high attack complexity reflects the need for attacker-controlled input to reach the vulnerable function. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data is not provided, and the CVSS base score of 4.0 (Medium) reflects a narrowly scoped integrity impact without confidentiality or availability consequences.
Prototype Pollution in the mongo-object npm package (versions before 3.0.3) allows network-reachable attackers to corrupt the JavaScript Object.prototype by supplying crafted property paths containing special keys such as __proto__, constructor, or prototype to the expandKey() function in util.ts. No authentication or user interaction is required, though high attack complexity reflects the need for attacker-controlled input to reach the vulnerable function. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data is not provided, and the CVSS base score of 4.0 (Medium) reflects a narrowly scoped integrity impact without confidentiality or availability consequences.