Prototype Pollution Vulnerability in Mongo-Object by Long Shot Labs
CVE-2026-16266

6.3MEDIUM

Key Information:

Vendor

Long Shot Labs

Status
Mongo-object
Vendor
CVE Published:
21 July 2026

What is CVE-2026-16266?

Versions of the mongo-object package prior to 3.0.3 are susceptible to a security flaw that allows an attacker to manipulate the JavaScript prototype chain. This vulnerability is exploited through the expandKey() function in util.js, where an attacker can introduce a specially crafted property path containing keys like proto. Such manipulation can lead to unintended modifications within the prototype, potentially affecting application behavior and integrity. It is crucial for developers utilizing this library to upgrade to the latest version to mitigate this risk.

Affected Version(s)

mongo-object 0 < 3.0.3

References

https://security.snyk.io/vuln/SNYK-JS-MONGOOBJECT-13816714
https://github.com/longshotlabs/mongo-object/issues/27
https://github.com/longshotlabs/mongo-object/blob/4f7a570...

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dezhen Kong
.