PT-2024-35970 · Mongoose · Mongoose

Balles + 1 · Published 2024-11-26 · Updated 2025-11-10 · CVE-2024-53900

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.8.3

Description The issue is related to the improper use of the $where operator in Mongoose, which can lead to search injection and potentially allow a remote attacker to execute arbitrary code and gain read and write access to data. The vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries.

Recommendations For versions prior to 8.8.3, update to version 8.8.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the $where operator in match queries to minimize the risk of exploitation.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-01987

BIT-MONGOOSE-2024-53900

CVE-2024-53900

GHSA-M7XQ-9374-9RVX

Affected Products

Mongoose

References · 44

• https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156 · Patch
• https://github.com/advisories/GHSA-m7xq-9374-9rvx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53900 · Security Note
• https://bdu.fstec.ru/vul/2025-01987 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53900 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m7xq-9374-9rvx · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongoose-2024-53900 · Vendor Advisory
• https://github.com/Automattic/mongoose · Note
• https://github.com/Automattic/mongoose/releases · Note
• https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md · Note
• https://github.com/Automattic/mongoose/commit/bbb6fa7ecb44bbaf5bea955d886378a1247bce0b · Note
• https://github.com/Automattic/mongoose/compare/7.8.2...7.8.3 · Note
• https://github.com/Automattic/mongoose/commit/33679bcf8ca43d74e3e8ecd4cc224826772d805b · Note
• https://github.com/Automattic/mongoose/compare/6.13.4...6.13.5 · Note
• https://github.com/Automattic/mongoose/compare/8.8.2...8.8.3 · Note