CVE-2026-15698

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15698

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15698.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15698

Published

2026-07-14T15:30:10.077Z

Modified

2026-07-16T03:48:17.586805912Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

kofrasa mingo Update API updateMany prototype pollution

Details

A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation of the argument Set can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. Upgrading to version 7.2.2 will fix this issue. This patch is called fadc398251792c2ba441cbc539f359fc7943c0c2. It is recommended to upgrade the affected component.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15698.json",
    "cwe_ids": [
        "CWE-1321",
        "CWE-94"
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/kofrasa/mingo

Affected ranges

Type

GIT

Repo

https://github.com/kofrasa/mingo

Events

Introduced

a09fa80ec4d249cf636d923ea951f50fdd3f3274

Fixed

fadc398251792c2ba441cbc539f359fc7943c0c2

Fixed

d83572cfab557e922d29e49796e9072a13f237d9

Database specific

{
    "extracted_events": [
        {
            "introduced": "7.2.0"
        },
        {
            "last_affected": "7.2.0"
        },
        {
            "introduced": "7.2.1"
        },
        {
            "last_affected": "7.2.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

7.*

7.2.0

7.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15698.json"