What is GHSA-9m93-w8w6-76hh?

GHSA-9m93-w8w6-76hh is a security advisory published by GitHub Security Advisories with Critical severity. Mongoose Prototype Pollution vulnerability

Which CVE IDs does GHSA-9m93-w8w6-76hh cover?

GHSA-9m93-w8w6-76hh covers the following CVE IDs: CVE-2023-3696. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9m93-w8w6-76hh?

GHSA-9m93-w8w6-76hh has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-9m93-w8w6-76hh?

GHSA-9m93-w8w6-76hh affects 3 products, including: npm/mongoose:\u003e= 7.0.0, \u003c 7.3.3; npm/mongoose:\u003e= 6.0.0, \u003c 6.11.3; npm/mongoose:\u003c 5.13.20.

GHSA-9m93-w8w6-76hhCriticalCVSS 10.0

Mongoose Prototype Pollution vulnerability

Vendor

GitHub Security Advisories

Published

July 17, 2023

Last Modified

November 29, 2023

🔗 CVE IDs covered (1)

CVE-2023-3696 →

📋 Description

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

🎯 Affected products3

npm/mongoose:>= 7.0.0, < 7.3.3
npm/mongoose:>= 6.0.0, < 6.11.3
npm/mongoose:< 5.13.20

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2023-3696
https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d
https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467
https://github.com/Automattic/mongoose/commit/e29578d2ec18a68aeb4717d66dd5eb66bae53de1
https://github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2
https://github.com/Automattic/mongoose/releases/tag/7.3.3
https://github.com/advisories/GHSA-9m93-w8w6-76hh