CVE-2023-3696 Prototype Pollution in automattic/mongoose
Prototype pollution in Mongoose allows attackers to manipulate object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3696?
CVE-2023-3696 is a critical vulnerability in automattic/mongoose, published on 17 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
Weakness: CWE-1321
Which versions are affected by CVE-2023-3696?
7 open source packages ship an affected version, including mongoose. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mongoose Bitnami | All versions | 5.13.20, 6.11.3, 7.3.4 |
mongoose npm | All versions | 5.13.20 |
mongoose npm | All versions | 5.13.20 |
mongoose npm | From 6.0.0 | 6.11.3 |
mongoose npm | From 6.0.0 | 6.11.3 |
mongoose npm | From 7.0.0 | 7.3.3 |
1 more packages
mongoose npm | From 7.0.0 | 7.3.3 |
Products include Mongoosejs Mongoose.
How do I fix CVE-2023-3696?
Upgrade mongoose to a fixed version for your release line: 5.13.20, 6.11.3, 7.3.4 or 7.3.3.
Is CVE-2023-3696 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3696 exists.
Other vulnerabilities in automattic/mongoose
- CVE-2024-53900 Mongoose search injection vulnerability
- CVE-2019-17426 Improper Input Validation in Automattic Mongoose
- CVE-2025-23061 Mongoose search injection vulnerability
- CVE-2026-42334 Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
- CVE-2022-2564 Prototype Pollution in automattic/mongoose
Sources
Also known as BIT-mongoose-2023-3696, GHSA-9m93-w8w6-76hh, ROOT-APP-NPM-CVE-2023-3696.