Junglewise Threat Intelligence

CVE-2026-15698: kofrasa mingo prototype pollution in Update API

CVE-2026-15698 · Severity: medium · CVSS 6.3 · Published 2026-07-14

Executive brief

kofrasa mingo is a library that provides a MongoDB-like query language for in-memory JavaScript objects. A security flaw in its update API allows an attacker to modify the base properties of all objects within the application environment. This can lead to unauthorized data modification, application crashes, or potentially further security compromises depending on how the application uses these objects.

Technical details

A prototype pollution vulnerability exists in the kofrasa mingo library's Update API. The root cause is improperly controlled modification of object prototype attributes when processing update paths in the update, updateOne, and updateMany functions. Specifically, the library fails to validate or sanitize dangerous path segments such as '__proto__', 'constructor', and 'prototype' within the '$set' argument. A remote attacker with the ability to provide user-controlled update documents can exploit this to inject properties into Object.prototype, affecting all objects in the JavaScript runtime. This issue is addressed in version 7.2.2 by validating selectors to ensure they do not target prototype properties.

Affected products

  • kofrasa mingo up to 7.2.1

Timeline

  • 2026-06-09: disclosed: Issue reported via GitHub issue #606
  • 2026-06-16: patched: Fix committed to main branch
  • 2026-07-14: advisory: CVE published and NVD entry created

References