Executive brief
A vulnerability exists in the CartoDB carto-api-client library, which is used by developers to interact with CARTO geospatial data APIs. An attacker can exploit this flaw to inject malicious properties into the application's core memory structures. This can lead to unpredictable application behavior, service crashes, or the bypassing of security logic, depending on how the library is integrated into a specific system.
Technical details
A prototype pollution vulnerability exists in CartoDB carto-api-client 0.5.29 within the `addFilter` function in `src/filters.ts`. The root cause is the use of the user-controlled `column` argument as a dynamic property key without sanitization. By passing a value such as `__proto__`, an attacker can bypass property existence checks and write arbitrary data to `Object.prototype`. This vulnerability can be exploited remotely if an application passes untrusted input to the `addFilter` function. Successful exploitation allows an attacker to modify the behavior of all objects in the JavaScript environment, potentially leading to Denial of Service (DoS) or remote code execution depending on the application's logic. As of the advisory date, the project has not yet released a patch.
Affected products
- CartoDB carto-api-client 0.5.29
Timeline
- 2026-06-12: disclosed: Issue reported to the project maintainers via GitHub issue #299
- 2026-07-18: advisory: CVE-2026-16151 published via VulDB/NVD