CVE-2026-125118mediumCWE-1321

CVE-2026-125118: fallo de gravedad media en Automattic mongoose

Mongoose: Prototype pollution via Schema.prototype.virtual()

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear mongoose+ Monitorear mongoose

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.4%
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as __proto__, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Productos afectados
Automattic · mongoose
CVEs relacionadas — Automattic mongoose

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-125117HIGHMongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema stateEPSS 0.6%CVE-2026-125120CRITICALMongoose: sanitizeFilter not applied on countDocumentsEPSS 0.6%CVE-2026-125119HIGHMongoose: Connection-level sanitizeFilter not appliedEPSS 0.5%CVE-2026-73562MEDIUMMongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)EPSS 0.5%CVE-2026-125116MEDIUMMongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collectionsEPSS 0.3%CVE-2026-42334HIGHMongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionEPSS 0.3%