The vulnerability CVE-2026-16151 affects CartoDB's carto-api-client version 0.5.29. It is caused by insufficient validation or control over the column argument in the addFilter function located in src/filters.ts. This flaw permits an attacker to remotely manipulate object prototype attributes improperly, which can lead to unexpected behavior or security issues related to prototype pollution. The vendor has been informed but has not yet provided a fix or official response. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

An attacker can remotely exploit this vulnerability to modify object prototype attributes within the affected application. This can lead to altered application behavior, potential security bypasses, or other unintended consequences related to prototype pollution. The impact is considered medium severity based on the CVSS score of 5.3. There are no known exploits in the wild at this time.

As of the current information, no official patch or remediation is available from the vendor. Users of CartoDB carto-api-client version 0.5.29 should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the affected functionality or applying application-level input validation to mitigate the risk of prototype pollution via the addFilter function.