CVE-2026-125118mediumCWE-1321

CVE-2026-125118: falha de média gravidade em Automattic mongoose

Mongoose: Prototype pollution via Schema.prototype.virtual()

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mongoose+ Monitorar mongoose

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as __proto__, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
Automattic · mongoose
CVEs relacionadas — Automattic mongoose

No mesmo produto, das mais perigosas para as menos.

CVE-2026-125117HIGHMongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema stateEPSS 0.6%CVE-2026-125120CRITICALMongoose: sanitizeFilter not applied on countDocumentsEPSS 0.6%CVE-2026-125119HIGHMongoose: Connection-level sanitizeFilter not appliedEPSS 0.5%CVE-2026-73562MEDIUMMongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)EPSS 0.5%CVE-2026-125116MEDIUMMongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collectionsEPSS 0.3%CVE-2026-42334HIGHMongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionEPSS 0.3%