GHSA-rc4v-99cr-pjcm Prototype Pollution in ali-security/mongoose
- Exploited in the wild
- Not known
- Fix
- Available
What is GHSA-rc4v-99cr-pjcm?
GHSA-rc4v-99cr-pjcm is a vulnerability in @seal-security/mongoose-fixed, published on 17 Oct 2023.
Official description
Impact
This vulnerability causes a Prototype Pollution in document.js, through functions such as findByIdAndUpdate(). For applications using Express and EJS, this can potentially allow remote code execution.
Patches
The original patched version for mongoose 5.3.3 did not include a fix for CVE-2023-3696. Therefore the existing version @seal-security/mongoose-fixed version 5.3.3 is affected by this vulnerability (though it is protected from CVE-2022-2564 and CVE-2019-17426). To mitigate this issue, a @seal-security/mongoose-fixed version 5.3.4 has been deployed. Note that this version is compatible with the original mongoose version 5.3.3, not version 5.3.4
References
https://security.snyk.io/vuln/SNYK-JS-MONGOOSE-5777721 https://github.com/advisories/GHSA-9m93-w8w6-76hh https://github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2
Which versions are affected by GHSA-rc4v-99cr-pjcm?
2 open source packages ship an affected version, including @seal-security/mongoose-fixed.
| Package | Affected | Fixed in |
|---|---|---|
@seal-security/mongoose-fixed npm | From 5.3.3 | 5.3.4 |
@seal-security/mongoose-fixed npm | From 5.3.3 | 5.3.4 |
How do I fix GHSA-rc4v-99cr-pjcm?
Upgrade @seal-security/mongoose-fixed to 5.3.4 or later.
Is GHSA-rc4v-99cr-pjcm being exploited?
There is no known exploitation of GHSA-rc4v-99cr-pjcm in the wild and no public exploit code.