Skip to content
OpenAdvisories
Critical · 10.0 CVE-2023-3696 BIT-mongoose-2023-3696EUVD-2023-2016GHSA-9m93-w8w6-76hh

Prototype Pollution in automattic/mongoose

Published Jul 17, 2023 · Updated Oct 30, 2024 · Assigned by @huntrdev

Vendor: Automattic Product: automattic/mongoose Package: mongoose Ecosystem: npm

Description

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

Affected products

VendorProductAffectedFixed
automattic automattic/mongoose unspecified – < 7.3.4 7.3.4

Affected packages

EcosystemPackageAffectedFixedRecord
npm mongoose >= 7.0.0, < 7.3.3 7.3.3 GHSA-9m93-w8w6-76hh
npm mongoose >= 6.0.0, < 6.11.3 6.11.3 GHSA-9m93-w8w6-76hh
npm mongoose < 5.13.20 5.13.20 GHSA-9m93-w8w6-76hh

References