CVE-2018-16490: Mpath Project Mpath

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

Affected products

• Mpath Project Mpath: before 0.5.1 (fixed in 0.5.1)

Published 2019-02-01. Last modified 2026-06-17.