{"id":"CVE-2026-16266","details":"Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__.","modified":"2026-07-25T03:56:36.623752236Z","published":"2026-07-21T05:00:00.647Z","database_specific":{"cna_assigner":"snyk","cwe_ids":["CWE-1321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16266.json"},"references":[{"type":"WEB","url":"https://github.com/longshotlabs/mongo-object/blob/4f7a570f2a2fcfa9417b7870d5f859e9574ec73c/src/util.ts%23L251"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-MONGOOBJECT-13816714"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16266.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16266"},{"type":"REPORT","url":"https://github.com/longshotlabs/mongo-object/issues/27"},{"type":"FIX","url":"https://github.com/longshotlabs/mongo-object/commit/638314107d8b397e5453c28e41729522b3e8d67c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/longshotlabs/mongo-object","events":[{"introduced":"0"},{"fixed":"189e05e3a91cf15c79f0fd4a565ae2d501d10bd9"},{"fixed":"638314107d8b397e5453c28e41729522b3e8d67c"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"3.0.3"}]}}],"versions":["3.0.2","3.0.1","3.0.0","2.0.0","1.0.0","0.2.0","0.1.4","0.1.3","0.1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16266.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}