Mongoose, a MongoDB object modeling tool, improperly controls modification of object prototype attributes (CWE-1321) in versions prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2. When user input containing a __proto__.x dotted path under $set is passed to update methods like MyModel.updateOne(filter, req.body), the update casting process treats inherited schema properties as schema types. This allows setting of $fullPath and $parentSchemaDocArray on Object.prototype before an error is thrown, resulting in prototype pollution. This pollution causes these properties to be visible on newly created objects, potentially impacting application integrity and availability. The issue is fixed in the stated versions.

The vulnerability allows an attacker to modify Object.prototype properties via crafted update inputs, leading to prototype pollution. This can cause unexpected behavior in applications using mongoose, affecting application integrity and availability. There is no direct confidentiality impact reported. No known exploits in the wild have been documented.

This vulnerability is fixed in mongoose versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed in the vendor advisory, but the fixed versions are clearly stated. No additional mitigation steps are indicated.