~ / search / GHSA-m7xq-9374-9rvx

GHSA-m7xq-9374-9rvx

Mongoose search injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-53900

Packages

EcosystemPackageAffectedFixed in
npm mongoose >= 8.0.0-rc0, < 8.8.3 8.8.3
npm mongoose >= 7.0.0-rc0, < 7.8.3 7.8.3
npm mongoose >= 6.0.0-rc0, < 6.13.5 6.13.5
npm mongoose >= 3.6.0-rc0, < 5.13.23 5.13.23

Details

As written in the advisory (Markdown source, shown as plain text).

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

References

External links from the advisory. They lead to third-party sites.