critical10.0
CVE-2023-3696
Mongoose Prototype Pollution vulnerability
Impact
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mongoose | >= 7.0.0, < 7.3.3 | 7.3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongoosejs | Mongoose | before 5.13.20 from 6.0.0 before 6.11.3 from 7.0.0 before 7.3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d
- https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467
- https://github.com/advisories/GHSA-9m93-w8w6-76hh
- https://nvd.nist.gov/vuln/detail/CVE-2023-3696
- https://github.com/Automattic/mongoose/commit/e29578d2ec18a68aeb4717d66dd5eb66bae53de1
- https://github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2
- https://github.com/Automattic/mongoose/releases/tag/7.3.3