Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

VectorNETWORK

PublishedJan 15, 2025, 05:15

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

mongoose(npm)8.0.0-rc08.9.5N/A

mongoose(npm)7.0.0-rc07.8.4N/A

mongoose(npm)06.13.6N/A

References

https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md
https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc
https://github.com/Automattic/mongoose/releases/tag/8.9.5
https://www.npmjs.com/package/mongoose?activeTab=versions

Weakness Type

CWE-94

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK