PT-2025-4804 · Mongoose · Mongoose

Vkarpov15

·

Published

2025-01-13

·

Updated

2025-10-31

·

CVE-2025-23061

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.9.5 Mongoose versions prior to 7.8.4 Mongoose versions prior to 6.13.6
Description Mongoose is susceptible to a search injection issue due to the improper handling of nested $where filters when used with populate(). The $where clause allows the execution of arbitrary JavaScript code within MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data. This issue stems from an incomplete fix for CVE-2024-53900. Approximately 2.7K+ services are estimated to be affected yearly. The vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries.
Recommendations Update Mongoose to version 8.9.5 or later. Update Mongoose to version 7.8.4 or later. Update Mongoose to version 6.13.6 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-01988
BIT-MONGOOSE-2025-23061
CVE-2025-23061
GHSA-VG7J-7CWX-8WGW

Affected Products

Mongoose