Open-source package vulnerability · npm

CVE-2025-23061: Mongoose search injection vulnerability

criticalCVSS 3.1 9.0GHSA-vg7j-7cwx-8wgw

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Published Jan 15, 2025 · Updated Jan 17, 2025

Affected packages

mongoose

Ecosystem: npm
Affected: >= 8.0.0-rc0, < 8.9.5
Fixed in: 8.9.5
Check: npm ls mongoose

mongoose

Ecosystem: npm
Affected: >= 7.0.0-rc0, < 7.8.4
Fixed in: 7.8.4
Check: npm ls mongoose

mongoose

Ecosystem: npm
Affected: < 6.13.6
Fixed in: 6.13.6
Check: npm ls mongoose

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Credited to skrtheboss.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology