Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
References
| Link | Resource |
|---|---|
| https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md | Release Notes |
| https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156 | Patch |
| https://github.com/Automattic/mongoose/releases | Release Notes |
| https://github.com/advisories/GHSA-m7xq-9374-9rvx | Vendor Advisory |
| https://www.npmjs.com/package/mongoose?activeTab=versions | Product |
Configurations
Configuration 1 (hide)
|
History
01 Oct 2025, 18:24
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mongoosejs
Mongoosejs mongoose |
|
| CPE | cpe:2.3:a:mongoosejs:mongoose:7.0.0:rc0:*:*:*:node.js:*:* cpe:2.3:a:mongoosejs:mongoose:8.0.0:rc0:*:*:*:node.js:*:* cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:* |
|
| References | () https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md - Release Notes | |
| References | () https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156 - Patch | |
| References | () https://github.com/Automattic/mongoose/releases - Release Notes | |
| References | () https://github.com/advisories/GHSA-m7xq-9374-9rvx - Vendor Advisory | |
| References | () https://www.npmjs.com/package/mongoose?activeTab=versions - Product |
Information
Published : 2024-12-02 20:15
Updated : 2025-10-01 18:24
NVD link : CVE-2024-53900
Mitre link : CVE-2024-53900
CVE.ORG link : CVE-2024-53900
JSON object : View
Products Affected
mongoosejs
- mongoose
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')