CVE-2025-23061
- Source
- https://cve.org/CVERecord?id=CVE-2025-23061
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23061.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-23061
- Aliases
- Published
- 2025-01-15T00:00:00Z
- Modified
- 2026-05-18T05:56:15.100791003Z
- Severity
-
- 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23061.json", "cna_assigner": "mitre", "cwe_ids": [ "CWE-94" ] }- References
-
- https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md
- https://github.com/Automattic/mongoose/releases/tag/8.9.5
- https://www.npmjs.com/package/mongoose?activeTab=versions
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23061.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-23061
- https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc
Affected packages
Git / github.com/automattic/mongoose
Affected versions
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.1.0
8.1.1
8.1.2
8.1.3
8.2.0
8.2.1
8.2.2
8.2.3
8.2.4
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.4.1
8.4.2
8.4.3
8.4.4
8.4.5
8.5.0
8.5.1
8.5.2
8.5.3
8.5.4
8.5.5
8.6.0
8.6.1
8.6.2
8.6.3
8.6.4
8.7.0
8.7.1
8.7.2
8.7.3
8.8.0
8.8.1
8.8.2
8.8.3
8.8.4
8.9.0
8.9.1
8.9.2
8.9.3
8.9.4