CVE-2026-16151: CartoDB carto-api-client RCE Vulnerability

CVE-2026-16151 Overview

CVE-2026-16151 is a prototype pollution vulnerability in CartoDB carto-api-client version 0.5.29. The flaw resides in the addFilter function within src/filters.ts. Attackers can manipulate the column argument to modify object prototype attributes, an issue classified under [CWE-94] (Improper Control of Generation of Code). The vulnerability is remotely exploitable and requires low-privilege authenticated access. The maintainers received an early issue report but have not responded at the time of publication.

Critical Impact
Remote attackers with low privileges can pollute JavaScript object prototypes through the addFilter function, potentially altering application logic, bypassing security checks, or enabling downstream code injection in applications consuming the client.

Affected Products

CartoDB carto-api-client version 0.5.29
Downstream JavaScript and TypeScript applications importing the vulnerable addFilter function from src/filters.ts
Web applications integrating CARTO mapping and analytics APIs through the affected client library

Discovery Timeline

2026-07-18 - CVE-2026-16151 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16151

Vulnerability Analysis

The vulnerability is a prototype pollution flaw in the addFilter function of src/filters.ts in the CartoDB carto-api-client package. Prototype pollution occurs when user-controlled input is used to set properties on an object without validating whether those properties reference internal prototype keys such as __proto__, constructor, or prototype. When the column argument is set to one of these reserved keys, the assignment propagates to Object.prototype, affecting every object in the JavaScript runtime.

Because carto-api-client is a client-side library used to build filters for CARTO data queries, the column parameter is typically supplied by application code that may forward user input. Any application that passes untrusted values into addFilter inherits this weakness. The impact scope depends on how downstream code consumes prototype-derived properties, but common effects include altered configuration flags, bypassed input checks, and unexpected control flow.

Root Cause

The root cause is missing key validation in addFilter when assigning filter definitions keyed by the column argument. The function trusts caller-supplied property names and writes them directly into an object without a safe-property check or the use of Object.create(null) for the backing map. This aligns with [CWE-94] as tracked by the NVD entry.

Attack Vector

Exploitation requires an attacker to influence the column argument passed to addFilter. In web applications where filter columns are derived from URL parameters, form fields, or API payloads, an attacker submits __proto__ or constructor.prototype as the column name along with a controlled value. Once polluted, every subsequently created object exposes the injected property, which the vulnerable application or its dependencies may later read as a trusted setting.

See the GitHub Issue #299 Discussion and the VulDB CVE-2026-16151 Entry for additional technical context. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-16151

Indicators of Compromise

Requests containing __proto__, constructor, or prototype in query parameters, JSON bodies, or filter definitions targeting endpoints that use carto-api-client.
Unexpected properties appearing on generic JavaScript objects at runtime, particularly after calls into addFilter.
Application errors or behavior changes correlated with filter creation events in server logs.

Detection Strategies

Perform static analysis of application code that imports carto-api-client to identify any path where user input reaches the column argument of addFilter.
Deploy web application firewall rules that inspect request parameters for prototype-pollution key names such as __proto__ and constructor.prototype.
Enable runtime JavaScript instrumentation to alert when properties are written to Object.prototype during request handling.

Monitoring Recommendations

Log all inbound requests to endpoints backed by the CARTO client and retain the raw column values for forensic review.
Track dependency inventories to detect the presence of carto-api-client 0.5.29 across build artifacts and lockfiles.
Alert on anomalous JavaScript runtime exceptions such as TypeError bursts, which frequently follow successful prototype pollution.

How to Mitigate CVE-2026-16151

Immediate Actions Required

Inventory all applications and CI pipelines that depend on carto-api-client 0.5.29 using npm ls carto-api-client or equivalent tooling.
Restrict or sanitize the column argument at the application layer before calling addFilter, rejecting values that match __proto__, constructor, or prototype.
Treat any user-supplied filter column names as untrusted input and validate them against an allowlist of known database columns.

Patch Information

No vendor patch is available at the time of publication. The maintainers were notified through an early issue report but have not responded. Monitor the GitHub Repository for Carto API Client and GitHub Issue #299 Discussion for updates and release announcements.

Workarounds

Wrap calls to addFilter with a validation layer that permits only column names from a strict allowlist derived from the target dataset schema.
Freeze Object.prototype at application startup using Object.freeze(Object.prototype) to prevent runtime prototype modification.
Replace object literals used to store filter state with maps created via Object.create(null) or the Map type to eliminate prototype exposure.

bash

# Configuration example: allowlist-based validation before invoking addFilter
ALLOWED_COLUMNS="country,region,city,population,category"
if ! echo "$ALLOWED_COLUMNS" | tr ',' '\n' | grep -qx "$USER_COLUMN"; then
  echo "Rejected column value: $USER_COLUMN" >&2
  exit 1
fi