Threats tagged 'bit-mongoose-2026-73562'

A prototype pollution vulnerability exists in Automattic's mongoose before versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2. The issue arises when user-controlled updates with a __proto__.x dotted path under $set are passed to update functions, allowing modification of Object.prototype properties. This can affect application integrity and availability. The vulnerability has a CVSS score of 6.5 (medium severity).