CVE-2026-125118

{
  "id": "CVE-2026-125118",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-09T23:17:22.243",
  "lastModified": "2026-11-09T23:17:22.243",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as __proto__, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Automattic",
          "product": "mongoose",
          "versions": [
            {
              "version": "< 6.13.12",
              "status": "affected"
            },
            {
              "version": ">= 7.0.0, < 7.8.13",
              "status": "affected"
            },
            {
              "version": ">= 8.0.0, < 8.24.7",
              "status": "affected"
            },
            {
              "version": ">= 9.0.0, < 9.11.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Automattic/mongoose/commit/318f7e09dd363a1dfddb8180878488dccd2796d1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/commit/74df7769b5a8d89c4413b764029911ee915ea467",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/commit/7a2a6567abbb72c0430c8cc5b7942141844fecff",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/commit/fb467e6d33174293dc0360649f20ce68d99117a9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/releases/tag/6.13.12",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/releases/tag/7.8.13",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/releases/tag/8.24.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/releases/tag/9.11.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-6972-9mcm-vhwj",
      "source": "[email protected]"
    }
  ]
}