Dezhen Kong

**Name of the Vulnerable Software and Affected Versions** mongo-object versions prior to 3.0.3 **Description** Prototype Pollution occurs via the `expandKey()` function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as ` proto `. Prototype Pollution is a vulnerability where an attacker can manipulate the base object prototype of a JavaScript application, potentially leading to unexpected behavior or remote code execution. **Recommendations** Update mongo-object to version 3.0.3 or later. As a temporary workaround, restrict the use of the `expandKey()` function until the update is applied.