A vulnerability exists in the Update API of kofrasa mingo versions up to 7.2.1. Manipulation of the Set argument within the update, updateOne, or updateMany functions can cause an uncontrolled change of object prototype attributes, a classic prototype‑pollution flaw. This can allow a remote attacker to alter prototypes that the application may later use.

The affected product is kofrasa mingo, all releases up to and including 7.2.1. The security fix is deployed in version 7.2.2, which removes the prototype‑pollution issue. The fix is identified by commit fadc398251792c2ba441cbc539f359fc7943c0c2.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not in the CISA KEV catalog. Attackers can exploit it remotely by sending crafted update requests that include malicious Set arguments. Because prototype pollution can alter the behavior of any object that inherits from the polluted prototype, the exploited systems may exhibit unpredictable logic or state changes.