CVE-2026-16150

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16150", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-17T19:01:44.871Z", "datePublished": "2026-07-18T19:15:08.501Z", "dateUpdated": "2026-07-20T15:10:01.298Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-18T19:15:08.501Z"}, "title": "RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1321", "lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "RobinHerbots", "product": "Inputmask", "versions": [{"version": "5.0.0", "status": "affected"}, {"version": "5.0.1", "status": "affected"}, {"version": "5.0.2", "status": "affected"}, {"version": "5.0.3", "status": "affected"}, {"version": "5.0.4", "status": "affected"}, {"version": "5.0.5", "status": "affected"}, {"version": "5.0.6", "status": "affected"}, {"version": "5.0.7", "status": "affected"}, {"version": "5.0.8", "status": "affected"}, {"version": "5.0.9", "status": "affected"}], "cpes": ["cpe:2.3:a:robinherbots:inputmask:*:*:*:*:*:*:*:*"], "modules": ["Internal Deep Merge Helper"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-17T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-17T21:06:50.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "wjm1 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/379909", "name": "VDB-379909 | RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/379909/cti", "name": "VDB-379909 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16150", "name": "CVE-2026-16150 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856979", "name": "Submit #856979 | Node.js Inputmask 5.0.9 Prototype Pollution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/RobinHerbots/Inputmask/issues/2885", "tags": ["issue-tracking"]}, {"url": "https://github.com/RobinHerbots/Inputmask/", "tags": ["product"]}]}, "adp": [{"references": [{"url": "https://github.com/RobinHerbots/Inputmask/issues/2885", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T15:09:28.607894Z", "id": "CVE-2026-16150", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T15:10:01.298Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16150", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-17T19:01:44.871Z", "datePublished": "2026-07-18T19:15:08.501Z", "dateUpdated": "2026-07-20T15:10:01.298Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-18T19:15:08.501Z"}, "title": "RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1321", "lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "RobinHerbots", "product": "Inputmask", "versions": [{"version": "5.0.0", "status": "affected"}, {"version": "5.0.1", "status": "affected"}, {"version": "5.0.2", "status": "affected"}, {"version": "5.0.3", "status": "affected"}, {"version": "5.0.4", "status": "affected"}, {"version": "5.0.5", "status": "affected"}, {"version": "5.0.6", "status": "affected"}, {"version": "5.0.7", "status": "affected"}, {"version": "5.0.8", "status": "affected"}, {"version": "5.0.9", "status": "affected"}], "cpes": ["cpe:2.3:a:robinherbots:inputmask:*:*:*:*:*:*:*:*"], "modules": ["Internal Deep Merge Helper"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-17T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-17T21:06:50.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "wjm1 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/379909", "name": "VDB-379909 | RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/379909/cti", "name": "VDB-379909 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16150", "name": "CVE-2026-16150 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856979", "name": "Submit #856979 | Node.js Inputmask 5.0.9 Prototype Pollution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/RobinHerbots/Inputmask/issues/2885", "tags": ["issue-tracking"]}, {"url": "https://github.com/RobinHerbots/Inputmask/", "tags": ["product"]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16150", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T15:09:28.607894Z"}}}], "references": [{"url": "https://github.com/RobinHerbots/Inputmask/issues/2885", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T15:09:54.647Z"}}]}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:robinherbots:inputmask:*:*:*:*:*:*:*:*"], "modules": ["Internal Deep Merge Helper"], "product": "Inputmask", "vendor": "RobinHerbots", "versions": [{"status": "affected", "version": "5.0.0"}, {"status": "affected", "version": "5.0.1"}, {"status": "affected", "version": "5.0.2"}, {"status": "affected", "version": "5.0.3"}, {"status": "affected", "version": "5.0.4"}, {"status": "affected", "version": "5.0.5"}, {"status": "affected", "version": "5.0.6"}, {"status": "affected", "version": "5.0.7"}, {"status": "affected", "version": "5.0.8"}, {"status": "affected", "version": "5.0.9"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en RobinHerbots Inputmask hasta la versi\u00f3n 5.0.9. Este problema afecta a la funci\u00f3n extendDefaults/extendDefinitions/extendAliases en la biblioteca lib/dependencyLibs/extend.js del componente Internal Deep Merge Helper. La manipulaci\u00f3n resulta en una modificaci\u00f3n indebidamente controlada de atributos de prototipo de objeto. El ataque puede realizarse de forma remota. Se inform\u00f3 al proyecto del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencia, pero a\u00fan no ha respondido."}], "id": "CVE-2026-16150", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16150", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T15:09:28.607894Z", "version": "2.0.3"}}]}, "published": "2026-07-18T20:17:29.947", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/RobinHerbots/Inputmask/"}, {"source": "cna@vuldb.com", "url": "https://github.com/RobinHerbots/Inputmask/issues/2885"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-16150"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/856979"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/379909"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/379909/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/RobinHerbots/Inputmask/issues/2885"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1321"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.9"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Inputmask", "source": "cna", "vendor": "RobinHerbots"}, "product": "inputmask", "vendor": "robinherbots"}], "created": "2026-07-22T19:30:16.197074+00:00", "updated": "2026-08-01T08:15:03.963100+00:00", "vendors": ["robinherbots", "robinherbots$PRODUCT$inputmask"]}