CyberRota Analysis
AI-GeneratedVersions of the mongo-object package prior to 3.0.3 are susceptible to Prototype Pollution through the expandKey() function in util.js, allowing attackers to manipulate the JavaScript prototype chain by providing specially crafted property paths. This vulnerability could lead to unexpected behavior in applications relying on this package, potentially compromising data integrity or enabling further attacks. Developers and security teams using affected versions should prioritize patching to mitigate the risk associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__.