{"action":"Upgrade mongoose to 5.13.15 or later.","affected":[{"fixed":"6.4.6","introduced":"6.0.0"},{"fixed":"5.13.15","introduced":"0"}],"component":"mongoose","cve_ids":["CVE-2022-2564"],"ecosystem":"npm","epss":0.31301,"exploited":false,"fixed_versions":["6.4.6","5.13.15"],"ghsa_id":"GHSA-f825-f98c-gj3g","id":"tcs_01M5KFMY3FMN5ECKC3RZZBA9PH","modified_at":"2023-12-06T01:02:07.656454Z","published_at":"2022-07-29T00:00:18Z","references":["https://osv.dev/vulnerability/GHSA-f825-f98c-gj3g","https://nvd.nist.gov/vuln/detail/CVE-2022-2564","https://github.com/Automattic/mongoose/commit/99b418941e2fc974199b8e5bd9d382bb50bf680a","https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8","https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141","https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md","https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6","https://github.com/automattic/mongoose","https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"GHSA-f825-f98c-gj3g","url":"https://osv.dev/vulnerability/GHSA-f825-f98c-gj3g"}],"summary":"automattic/mongoose vulnerable to Prototype pollution via Schema.path"}