The mongo-object package includes a function named expandKey that accepts a property path string. In versions prior to 3.0.3, this function incorrectly processes special keys such as __proto__, allowing an attacker to inject values into the JavaScript prototype chain. By manipulating the prototype chain, an attacker can alter the behavior of code that relies on default object prototypes, potentially leading to security violations such as privilege escalation or data tampering.

The vulnerability affects the mongo-object NPM package in all released versions before 3.0.3. Systems that use this library and import the expandKey utility without upgrading are exposed.

The CVSS score of 6.3 indicates medium severity. The EPSS score of < 1% signals a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring an attacker to supply a crafted property path string to the expandKey function, which typically occurs in web or server‑side JavaScript contexts. No authentication or privilege escalation prerequisites are explicitly stated in the description.