CVE-2026-16150 Details

A prototype pollution vulnerability has been identified in RobinHerbots Inputmask versions through 5.0.9. The issue arises in the internal deep merge helper function, which is part of the library's dependency management. The vulnerability allows for uncontrolled modification of object prototype attributes, potentially leading to malicious exploitation from remote sources.

To address this vulnerability, it is recommended to reject any objects that attempt to perform prototype pollution before they are processed. Additionally, the deep merge function should be modified to only iterate over own enumerable properties, and to use 'Object.create(null)' for dynamic merge maps where suitable.