Vulnerability Description
Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/longshotlabs/mongo-object/blob/4f7a570f2a2fcfa9417b7870d5f859
- https://github.com/longshotlabs/mongo-object/commit/638314107d8b397e5453c28e4172
- https://github.com/longshotlabs/mongo-object/issues/27
- https://security.snyk.io/vuln/SNYK-JS-MONGOOBJECT-13816714
- https://github.com/longshotlabs/mongo-object/issues/27
FAQ
What is CVE-2026-16266?
CVE-2026-16266 is a vulnerability with a CVSS score of 4.0 (MEDIUM). Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a cr...
How severe is CVE-2026-16266?
CVE-2026-16266 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-16266?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.