mongoose 3.6.20 vulnerabilities

Known vulnerabilities in the mongoose package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H Improper Neutralization of Special Elements in Data Query Logic mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper handling of `$where` in match queries. An attacker can manipulate search queries to inject malicious code. How to fix Improper Neutralization of Special Elements in Data Query Logic? Upgrade `mongoose` to version 8.8.3 or higher.	<8.8.3
H Prototype Pollution mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution in `document.js`, via update functions such as `findByIdAndUpdate()`. This allows attackers to achieve remote code execution. Note: Only applications using Express and EJS are vulnerable. How to fix Prototype Pollution? Upgrade `mongoose` to version 5.13.20, 6.11.3, 7.3.4 or higher.	<5.13.20>=6.0.0-rc0 <6.11.3>=7.0.0-rc0 <7.3.4
H Prototype Pollution mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution in the `Schema.path()` function. Note: CVE-2022-24304 is a duplicate of CVE-2022-2564. How to fix Prototype Pollution? Upgrade `mongoose` to version 5.13.15, 6.4.6 or higher.	<5.13.15>=6.0.0 <6.4.6
M Prototype Pollution mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The `mongoose.Schema()` function is subject to prototype pollution due to the recursively calling of `Schema.prototype.add()` function to add new items into the schema object. This vulnerability allows modification of the Object prototype. PoC `mongoose = require('mongoose'); mongoose.version; //'5.12.0' var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}'; console.log('Before:', {}.polluted); // undefined mongoose.Schema(JSON.parse(malicious_payload)); console.log('After:', {}.polluted); // HACKED` How to fix Prototype Pollution? Upgrade `mongoose` to version 5.12.2 or higher.	<5.12.2
M Information Exposure mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Information Exposure. Any query object with a `_bsontype` attribute is ignored, allowing attackers to bypass access control. How to fix Information Exposure? Upgrade `mongoose` to version 4.13.21, 5.7.5 or higher.	<4.13.21>=5.0.0 <5.7.5
M Remote Memory Exposure A potential memory disclosure vulnerability exists in mongoose. A `Buffer` field in a MongoDB document can be used to expose sensitive information such as code, runtime memory and user data into MongoDB.	>=3.5.5 <3.8.39>=4.0.0 <4.3.6

Vulnerability

Vulnerable Version

Improper Neutralization of Special Elements in Data Query Logic

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper handling of $where in match queries. An attacker can manipulate search queries to inject malicious code.

How to fix Improper Neutralization of Special Elements in Data Query Logic?

Upgrade mongoose to version 8.8.3 or higher.

<8.8.3

Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in document.js, via update functions such as findByIdAndUpdate(). This allows attackers to achieve remote code execution.

Note: Only applications using Express and EJS are vulnerable.

How to fix Prototype Pollution?

Upgrade mongoose to version 5.13.20, 6.11.3, 7.3.4 or higher.

<5.13.20>=6.0.0-rc0 <6.11.3>=7.0.0-rc0 <7.3.4

Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in the Schema.path() function.

Note: CVE-2022-24304 is a duplicate of CVE-2022-2564.

How to fix Prototype Pollution?

Upgrade mongoose to version 5.13.15, 6.4.6 or higher.

<5.13.15>=6.0.0 <6.4.6

Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The mongoose.Schema() function is subject to prototype pollution due to the recursively calling of Schema.prototype.add() function to add new items into the schema object. This vulnerability allows modification of the Object prototype.

PoC

mongoose = require('mongoose');
mongoose.version; //'5.12.0'
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mongoose.Schema(JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // HACKED

How to fix Prototype Pollution?

Upgrade mongoose to version 5.12.2 or higher.

<5.12.2

Information Exposure

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Information Exposure. Any query object with a _bsontype attribute is ignored, allowing attackers to bypass access control.

How to fix Information Exposure?

Upgrade mongoose to version 4.13.21, 5.7.5 or higher.

<4.13.21>=5.0.0 <5.7.5

Remote Memory Exposure

A potential memory disclosure vulnerability exists in mongoose. A Buffer field in a MongoDB document can be used to expose sensitive information such as code, runtime memory and user data into MongoDB.

>=3.5.5 <3.8.39>=4.0.0 <4.3.6

mongoose@3.6.20 vulnerabilities

Mongoose MongoDB ODM

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?

PoC