Skip to content
Sign in
9.0 Critical

CVE-2025-23061 Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection

Description

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Affected products and versions

Product Affected versions Fixed in
Mongoose 8.0 8.0.0 → < 8.9.5 8.9.5
Mongoose 7.0 7.0.0 → < 7.8.4 7.8.4
Mongoose 6.0 6.0.0 → < 6.13.6 6.13.6

Other CVEs of Mongoose

The 2 CVEs of Mongoose →
CVE-2023-3696 Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4 10.0 Critical
Track this CVE