CVE-2026-15698: Kofrasa Mingo RCE Vulnerability

CVE-2026-15698 Overview

CVE-2026-15698 is a prototype pollution vulnerability affecting the kofrasa/mingo JavaScript library through version 7.2.1. The flaw resides in the Update API, specifically the update, updateOne, and updateMany functions. An attacker who can manipulate the Set argument can trigger improperly controlled modification of Object.prototype attributes [CWE-94]. The vulnerability is exploitable remotely and requires low privileges. The maintainer resolved the issue in version 7.2.2 via commit fadc398251792c2ba441cbc539f359fc7943c0c2.

Critical Impact
Successful exploitation enables attackers to pollute the JavaScript object prototype chain, potentially leading to application logic tampering, denial of service, or downstream code execution in Node.js applications that use mingo for MongoDB-style query and update operations.

Affected Products

kofrasa/mingo versions up to and including 7.2.1
Node.js applications embedding mingo for in-memory MongoDB query processing
Downstream libraries that depend on mingo's Update API

Discovery Timeline

2026-07-14 - CVE-2026-15698 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15698

Vulnerability Analysis

The mingo library provides MongoDB-style query and update operators for JavaScript objects. The Update API processes user-supplied selectors that reference nested object paths using dot notation. Before the patch, selector strings were split into path arrays and passed into the internal resolve and resolveGraph functions without validating whether the resulting keys collided with Object.prototype properties such as __proto__, constructor, or prototype.

An attacker supplying a crafted $set operator such as { "__proto__.polluted": "value" } could walk the prototype chain and assign attacker-controlled values to properties inherited by every object in the runtime. Applications that later read those properties may execute unintended logic paths.

The Exploit Prediction Scoring System (EPSS) rates this issue at 0.262% probability of exploitation within 30 days.

Root Cause

The root cause is missing validation of prototype-reserved property names in path-resolution helpers. The pre-patch code eagerly built a pathArray from the raw selector and forwarded it into resolution routines that used bracket-notation writes. Because JavaScript allows writes through __proto__ and constructor.prototype, any dotted selector containing those tokens reached prototype-modifying code paths.

Attack Vector

Exploitation requires the attacker to influence the Set argument passed to update, updateOne, or updateMany. This is commonly reachable when an HTTP endpoint forwards untrusted JSON bodies into mingo update operations without schema validation. The attack occurs over the network and requires low privileges but no user interaction.

typescript

// Security patch in src/operators/_predicates.ts
// Source: https://github.com/kofrasa/mingo/commit/fadc398251792c2ba441cbc539f359fc7943c0c2
   options: Options,
   predicate: QueryPredicate
 ): (_: AnyObject) => boolean {
-  const pathArray = selector.split(".");
-  const depth = Math.max(1, pathArray.length - 1);
+  const depth = Math.max(1, selector.split(".").length - 1);
   const copts = ComputeOptions.init(options).update({ depth });
-  const opts = { unwrapArray: true, pathArray };
+  const opts = { unwrapArray: true };
   if (predicate === $elemMatch) {
     value = elemMatchPredicate(value as AnyObject, options);
   }

typescript

// Security patch in src/operators/query/element/exists.ts
// Source: https://github.com/kofrasa/mingo/commit/fadc398251792c2ba441cbc539f359fc7943c0c2
   const b = !!value;
   // top-level keys and array elements.
   if (!nested || selector.match(/\.\d+$/)) {
-    const opts = { pathArray: selector.split(".") };
-    return (o: AnyObject) => (resolve(o, selector, opts) !== undefined) === b;
+    return (o: AnyObject) => (resolve(o, selector) !== undefined) === b;
   }
   // for nested keys we resolve the entire value path so we don't confuse array scalars with plural values.
   const parentSelector = selector.substring(0, selector.lastIndexOf("."));
-  const opts = { pathArray: parentSelector.split("."), preserveIndex: true };
+  const opts = { preserveIndex: true };
   return (o: AnyObject) => {
     const path = resolveGraph(o, selector, opts) as AnyObject;
-    const val = resolve(path, parentSelector, opts);
+    const val = resolve(path, parentSelector);
     return isArray(val)
       ? val.some(v => v !== undefined) === b
       : (val !== undefined) === b;

The patch removes the pre-computed pathArray option that bypassed prototype-safe key handling, forcing the resolver to re-derive paths through validated helpers.

Detection Methods for CVE-2026-15698

Indicators of Compromise

Request payloads containing __proto__, constructor.prototype, or prototype tokens inside $set or update operator fields.
Unexpected properties appearing on plain objects at runtime, particularly properties that were never explicitly assigned.
Application error logs referencing mingo update operators with malformed selectors.

Detection Strategies

Perform a software composition analysis (SCA) scan of package.json and package-lock.json files to identify mingo versions at or below 7.2.1.
Add runtime input inspection on any endpoint that forwards JSON into mingo update APIs, flagging keys that match prototype-reserved names.
Review Node.js process telemetry for anomalous global property reads that could indicate successful prototype pollution.

Monitoring Recommendations

Log all invocations of update, updateOne, and updateMany along with the sanitized top-level keys of the update document.
Monitor for HTTP requests containing the string __proto__ in request bodies against services known to use mingo.
Alert on unexpected behavior changes in server-side authorization checks that rely on default object property lookups.

How to Mitigate CVE-2026-15698

Immediate Actions Required

Upgrade mingo to version 7.2.2 or later, which contains commit fadc398251792c2ba441cbc539f359fc7943c0c2.
Audit application code paths that pass untrusted input to update, updateOne, or updateMany.
Add schema validation to reject request payloads that include prototype-reserved keys before they reach mingo.

Patch Information

The fix is available in mingo release 7.2.2. See the GitHub release notes and the security commit. Additional context is available in the issue tracker discussion and the VulDB advisory.

Workarounds

Wrap all user-controlled update documents with a sanitizer that strips keys equal to __proto__, constructor, or prototype prior to invoking mingo.
Freeze Object.prototype at process startup using Object.freeze(Object.prototype) where compatibility allows.
Use Object.create(null) for objects that receive user-controlled properties to eliminate the prototype chain as an attack surface.

bash

# Upgrade mingo to the patched release
npm install mingo@7.2.2

# Verify the installed version
npm ls mingo