mongoose@4.13.21 vulnerabilities

Mongoose MongoDB ODM

Direct Vulnerabilities

Known vulnerabilities in the mongoose package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in the Schema.path() function.

How to fix Prototype Pollution?

Upgrade mongoose to version 5.13.15, 6.4.6 or higher.

<5.13.15 >=6.0.0 <6.4.6
  • M
Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The mongoose.Schema() function is subject to prototype pollution due to the recursively calling of Schema.prototype.add() function to add new items into the schema object. This vulnerability allows modification of the Object prototype.

PoC

mongoose = require('mongoose');
mongoose.version; //'5.12.0'
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mongoose.Schema(JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // HACKED

How to fix Prototype Pollution?

Upgrade mongoose to version 5.12.2 or higher.

<5.12.2