~ / search / GHSA-vg7j-7cwx-8wgw

GHSA-vg7j-7cwx-8wgw

Mongoose search injection vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-23061

Packages

EcosystemPackageAffectedFixed in
npm mongoose >= 8.0.0-rc0, < 8.9.5 8.9.5
npm mongoose >= 7.0.0-rc0, < 7.8.4 7.8.4
npm mongoose < 6.13.6 6.13.6

Details

As written in the advisory (Markdown source, shown as plain text).

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the `$where` operator. This vulnerability arises from the ability of the `$where` clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

References

External links from the advisory. They lead to third-party sites.