CVE-2026-15699 in compromise
Summary
by MITRE • 07/14/2026
A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b4644ab7179700df0607521f61c1ee9b5f78d89d. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/14/2026
This vulnerability resides within the spencermountain compromise library version 14.15.1 and earlier, specifically targeting the nlp.extend function located in src/API/extend.js. The flaw represents a prototype pollution vulnerability that occurs when the plugin argument passed to the extend function is improperly handled, allowing attackers to manipulate object prototype attributes without proper controls. This type of vulnerability falls under the CWE-471 category, which specifically addresses the modification of object prototype attributes, and aligns with ATT&CK technique T1059.007 for script injection and T1566 for malicious code injection.
The technical implementation of this vulnerability allows for remote exploitation through manipulation of the plugin parameter that gets processed by the nlp.extend function. When an attacker supplies a malicious plugin object containing properties that override prototype attributes, the library fails to properly validate or sanitize these inputs before incorporating them into the object structure. This creates a scenario where subsequent object instantiations or operations may inherit and execute unintended behaviors from the polluted prototype chain.
The operational impact of this vulnerability is significant as it enables attackers to perform remote code execution or manipulate application behavior by polluting the prototype chain of objects within the library's scope. The exploit being publicly available increases the risk level substantially, as it removes the requirement for advanced exploitation techniques and allows threat actors to leverage this weakness immediately. The vulnerability affects applications that utilize the spencermountain compromise library, potentially compromising any system where this library is integrated into processing pipelines or API endpoints.
Security mitigation requires immediate application of the vendor-provided patch identified by the commit hash b4644ab7179700df0607521f61c1ee9b5f78d89d. Organizations should conduct thorough vulnerability assessments to identify all instances where this library is used within their applications and infrastructure, particularly in public-facing APIs or services that accept user input. The vendor's prompt response and professional handling of the issue demonstrates responsible disclosure practices and provides confidence in the reliability of the fix. System administrators should also consider implementing runtime monitoring to detect anomalous prototype modifications and establish network segmentation to limit potential lateral movement if exploitation occurs.
The vulnerability highlights the importance of proper input validation and sanitization when processing external data within JavaScript applications, particularly those that manipulate object structures or extend functionality dynamically. This case demonstrates how seemingly benign API functions can become attack vectors when insufficient safeguards are implemented against prototype pollution attacks. Organizations should review their dependency management practices to ensure timely patching of known vulnerabilities and maintain awareness of security advisories from software vendors to prevent similar issues in other components of their technology stack.