CVE-2022-2564: automattic/mongoose vulnerable to Prototype pollution via Schema.path

The vulnerability stems from insufficient input validation in schema path handling. The GitHub commit a45cfb6 explicitly adds checks for special properties (like proto) in both add() and path() methods, confirming these were the entry points. The CVE description directly implicates Schema.path() as the vulnerable function, and the patch modifies both functions to prevent prototype pollution by rejecting special property keys. The high confidence comes from the direct correlation between the vulnerability description, CWE-1321 (Prototype Pollution), and the specific defensive code changes in these functions.