Description
A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the argument column leads to improperly controlled modification of object prototype attributes. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A defect in carto-api-client’s addFilter function permits a remote attacker who controls the column argument to manipulate object prototype attributes. By supplying specially crafted values the library induces prototype pollution, which can alter the behavior of objects that inherit from Object.prototype and affect other parts of the client code.

Affected Systems

The affected component is CartoDB carto-api-client version 0.5.29. No additional vendors, products, or version ranges are identified in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk level. The EPSS score of less than 1% shows a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, and the supplied data does not document a public exploit.

Generated by OpenCVE AI on July 30, 2026 at 22:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade carto-api-client to the latest release that contains a fix for the addFilter prototype pollution flaw.
  • If an upgrade is not possible, modify the addFilter implementation to sanitize the column argument, explicitly removing or neutralizing any keys that could alter Object.prototype.
  • Add strict input validation to reject column names that are reserved or could affect prototype attributes, ensuring only allowed property names are accepted.
  • Continuously monitor the CartoDB repository or issue tracker for updates, as the vendor has not yet responded to the reported issue.

Generated by OpenCVE AI on July 30, 2026 at 22:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 18 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the argument column leads to improperly controlled modification of object prototype attributes. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
Title CartoDB carto-api-client filters.ts addFilter prototype pollution
First Time appeared Cartodb
Cartodb carto-api-client
Weaknesses CWE-1321
CWE-94
CPEs cpe:2.3:a:cartodb:carto-api-client:*:*:*:*:*:*:*:*
Vendors & Products Cartodb
Cartodb carto-api-client
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Cartodb Carto-api-client
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-20T13:26:33.188Z

Reserved: 2026-07-17T19:30:24.070Z

Link: CVE-2026-16151

cve-icon Vulnrichment

Updated: 2026-07-20T13:26:20.748Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')