CVE-2023-3696

⛔ critical

🔍 Scan for this CVE

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

CVSS Score

9.8

Critical

EPSS Score

0.3

Exploit Probability

Published Date

2023-07-17

First Seen: 2026-01-05

This CVE is Very High Risk - more severe than 90.5% of all 338,292 vulnerabilities in our database.

#31,990

Top 10% most severe

Severity Percentile

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2024-11-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-1321

📦 Affected Products 3

Vendor	Product	Status	Affected Versions
mongoosejs	mongoose	Affected	< 5.13.20
mongoosejs	mongoose	Affected	≥ 6.0.0 < 6.11.3
mongoosejs	mongoose	Affected	≥ 7.0.0 < 7.3.4

Patch

Exploit Patch

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42334	⚠️ high	7.5	0.0	Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22...	2026-05-14
CVE-2025-23061	⛔ critical	9.0	64.8	Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NO...	2025-01-15
CVE-2024-53900	⛔ critical	9.1	45.9	Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.	2024-12-02
CVE-2022-2564	⛔ critical	9.8	2.9	Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.	2022-07-28
CVE-2019-17426	⛔ critical	9.1	0.2	Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query obj...	2019-10-10

These CVEs affect the same products