CVE-2026-16151

Name of the Vulnerable Software and Affected Versions CartoDB carto-api-client version 0.5.29

Description A remote attack is possible through the manipulation of the column argument within the addFilter() function located in the src/filters.ts file. This leads to prototype pollution, which is the improper modification of object prototype attributes, potentially allowing an attacker to alter the behavior of the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the addFilter() function to minimize the risk of exploitation.