Security Advisory

CVE-2026-16266

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-21 05:00:00

Last updated 2026-07-21 14:52:06

Assigner snyk

CVSS score 6.3

State PUBLISHED

Description

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__.

← Browse all CVEs View on cve.org ↗