9.0Crítica
CVE-2025-23061
Descripción
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Debilidad (CWE):
CWE-94
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| mongoosejs | Mongoose | 6.0.0 – < 6.13.6, 7.0.0 – < 7.8.4, 8.0.0 – < 8.9.5 |
Referencias y parches
- https://www.npmjs.com/package/mongoose?activeTab=versions Product
- https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md Release Notes
- https://github.com/Automattic/mongoose/releases/tag/8.9.5 Release Notes
- https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc Patch
Coincidencias CPE (NVD) (3)
cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*< 6.13.6cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*≥ 7.0.0 < 7.8.4cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*≥ 8.0.0 < 8.9.5