CVE-2026-16151

CVE-2026-16151 affects CartoDB’s carto-api-client 0.5.29, specifically the addFilter function in src/filters.ts. The issue is prototype pollution caused by manipulating the argument column, enabling remote manipulation of object prototype attributes. The vulnerability is reported as remote-execut...

CVE-2026-16151: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the argument column leads to improperly controlled modification of object prototype attributes. The attack can be executed remotely. The project...

PT-2026-60985

Name of the Vulnerable Software and Affected Versions CartoDB carto-api-client version 0.5.29 Description A remote attack is possible through the manipulation of the column argument within the addFilter function located in the src/filters.ts file. This leads to prototype pollution, which is the...