{"action":"Upgrade mongoose to 5.13.15 or later.","affected":[{"fixed":"6.4.6","introduced":"6.0.0"},{"fixed":"5.13.15","introduced":"0"}],"component":"mongoose","cve_ids":["CVE-2022-24304"],"ecosystem":"npm","exploited":false,"fixed_versions":["6.4.6","5.13.15"],"ghsa_id":"GHSA-h8hf-x3f4-xwgp","id":"tcs_01M5KFTJCQ2FFX6R2VKTG58VD2","modified_at":"2024-04-22T23:44:02.962119Z","published_at":"2022-08-27T00:00:54Z","references":["https://osv.dev/vulnerability/GHSA-h8hf-x3f4-xwgp","https://nvd.nist.gov/vuln/detail/CVE-2022-24304","https://github.com/Automattic/mongoose/issues/12085","https://github.com/Automattic/mongoose/commit/6a197316564742c0422309e1b5fecfa4faec126e","https://github.com/Automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8","https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141","https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-h8hf-x3f4-xwgp","url":"https://osv.dev/vulnerability/GHSA-h8hf-x3f4-xwgp"}],"summary":"Mongoose Vulnerable to Prototype Pollution in Schema Object"}