CVE-2026-16150

{
  "id": "CVE-2026-16150",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-18T20:17:29.947",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en RobinHerbots Inputmask hasta la versión 5.0.9. Este problema afecta a la función extendDefaults/extendDefinitions/extendAliases en la biblioteca lib/dependencyLibs/extend.js del componente Internal Deep Merge Helper. La manipulación resulta en una modificación indebidamente controlada de atributos de prototipo de objeto. El ataque puede realizarse de forma remota. Se informó al proyecto del problema con antelación a través de un informe de incidencia, pero aún no ha respondido."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "RobinHerbots",
          "product": "Inputmask",
          "cpes": [
            "cpe:2.3:a:robinherbots:inputmask:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Internal Deep Merge Helper"
          ],
          "versions": [
            {
              "version": "5.0.0",
              "status": "affected"
            },
            {
              "version": "5.0.1",
              "status": "affected"
            },
            {
              "version": "5.0.2",
              "status": "affected"
            },
            {
              "version": "5.0.3",
              "status": "affected"
            },
            {
              "version": "5.0.4",
              "status": "affected"
            },
            {
              "version": "5.0.5",
              "status": "affected"
            },
            {
              "version": "5.0.6",
              "status": "affected"
            },
            {
              "version": "5.0.7",
              "status": "affected"
            },
            {
              "version": "5.0.8",
              "status": "affected"
            },
            {
              "version": "5.0.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T15:09:28.607894Z",
          "id": "CVE-2026-16150",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/RobinHerbots/Inputmask/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/RobinHerbots/Inputmask/issues/2885",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-16150",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/submit/856979",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/379909",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/379909/cti",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/RobinHerbots/Inputmask/issues/2885",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}