by Kastro
Paper/Archive/CVE-2025-23061

CVE-2025-23061

mongoosejs Mongoose — Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.

EPSS 7%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.3.943 × 2018.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Affected

ProductAffectedFixed inSource
Mongoose6.0.0 – < 6.13.66.13.6CNA
Mongoose7.0.0 – < 7.8.47.8.4CNA
Mongoose8.0.0 – < 8.9.58.9.5CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refnpmjs.com/package/mongoose?activeTab=versionsrefgithub.com/Automattic/mongoose/blob/master/CHANGELOG.mdrefgithub.com/Automattic/mongoose/releases/tag/8.9.5refgithub.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc