Mongoose, a MongoDB object modeling library, has a prototype pollution vulnerability in the update casting logic. Prior to versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user‑controlled update payload that contains a __proto__ prefixed dotted path (for example __proto__.x) under $set causes the internal path resolution code to treat inherited properties as schema paths. This allows the casting process to set special internal fields ($fullPath and $parentSchemaDocArray) on Object.prototype before a thrown error. As a result, those properties become visible on newly created objects, potentially corrupting program state and causing integrity or availability problems.

Automattic's Mongoose library, versions prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2 are affected.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through any publicly exposed API that accepts update requests, where an attacker can supply a payload containing a __proto__ dotted path. Because the vulnerability manipulates the global Object prototype, a successful exploitation could alter the behavior of subsequently created objects, leading to integrity and availability issues. Given the absence of known active exploitation, the immediate risk is moderate, but the weakness should be remediated promptly.