CVE-2026-15698

MEDIUM

kofrasa mingo Update API updateMany prototype pollution

Title source: cna
STIX 2.1

Description

A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation of the argument Set can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. Upgrading to version 7.2.2 will fix this issue. This patch is called fadc398251792c2ba441cbc539f359fc7943c0c2. It is recommended to upgrade the affected component.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-378245 | kofrasa mingo Update API updateMany prototype pollution
https://vuldb.com/vuln/378245
Signature, Permissions Required signature permissions-required
VDB-378245 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/378245/cti
Third Party Advisory third-party-advisory
CVE-2026-15698 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15698
Third Party Advisory third-party-advisory
Submit #856014 | Node.js mingo 7.2.1 Prototype Pollution
https://vuldb.com/submit/856014
Issue Tracking issue-tracking
https://github.com/kofrasa/mingo/issues/606

Scores

CVSS v3 6.3
EPSS 0.0026
EPSS Percentile 17.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1321 CWE-94
Status published
Products (3)
kofrasa/mingo 7.2.0
kofrasa/mingo 7.2.1
kofrasa/mingo 7.2.2
Published Jul 14, 2026
Tracked Since Jul 14, 2026