-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mongoose | npm | >= 6.0.0, < 6.4.6 | 6.4.6 |
| mongoose | npm | < 5.13.15 | 5.13.15 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient input validation in schema path handling. The GitHub commit a45cfb6 explicitly adds checks for special properties (like proto) in both add() and path() methods, confirming these were the entry points. The CVE description directly implicates Schema.path() as the vulnerable function, and the patch modifies both functions to prevent prototype pollution by rejecting special property keys. The high confidence comes from the direct correlation between the vulnerability description, CWE-1321 (Prototype Pollution), and the specific defensive code changes in these functions.
JavaScriptJavaScriptOngoing coverage of React2Shell