CRITICAL9.8
GHSA-m7xq-9374-9rvx
Mongoose search injection vulnerability
Quick fix
GHSA-m7xq-9374-9rvx — mongoose: upgrade to the fixed version with the command below.
npm install mongoose@8.8.3Details
Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-53900[ADVISORY]
- https://github.com/github/advisory-database/pull/6769[WEB]
- https://github.com/github/advisory-database/pull/6776[WEB]
- https://github.com/Automattic/mongoose/commit/33679bcf8ca43d74e3e8ecd4cc224826772d805b[WEB]
- https://github.com/Automattic/mongoose/commit/bbb6fa7ecb44bbaf5bea955d886378a1247bce0b[WEB]
- https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156[WEB]
- https://github.com/Automattic/mongoose[PACKAGE]
- https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md[WEB]
- https://github.com/Automattic/mongoose/compare/6.13.4...6.13.5[WEB]
- https://github.com/Automattic/mongoose/compare/7.8.2...7.8.3[WEB]
- https://github.com/Automattic/mongoose/compare/8.8.2...8.8.3[WEB]
- https://github.com/Automattic/mongoose/releases[WEB]
- https://www.npmjs.com/package/mongoose?activeTab=versions[WEB]