9.0Kritisch
CVE-2025-23061
Beschreibung
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Schwachstellentyp (CWE):
CWE-94
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| mongoosejs | Mongoose | 6.0.0 – < 6.13.6, 7.0.0 – < 7.8.4, 8.0.0 – < 8.9.5 |
Referenzen und Patches
- https://www.npmjs.com/package/mongoose?activeTab=versions Product
- https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md Release Notes
- https://github.com/Automattic/mongoose/releases/tag/8.9.5 Release Notes
- https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc Patch
CPE-Treffer (NVD) (3)
cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*< 6.13.6cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*≥ 7.0.0 < 7.8.4cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*≥ 8.0.0 < 8.9.5