CVE-2025-23061
- Source
- https://cve.org/CVERecord?id=CVE-2025-23061
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23061.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-23061
- Aliases
- Published
- 2025-01-15T05:15:10.517Z
- Modified
- 2026-03-01T08:12:27.145758Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
- References
Affected packages
Git / github.com/automattic/mongoose
Affected ranges
- Type
- GIT
- Repo
- https://github.com/automattic/mongoose
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixed
Affected versions
5.*
5.13.17
6.*
6.10.1
6.10.2
6.10.3
6.10.4
6.10.5
6.11.0
6.11.1
6.11.2
6.11.3
6.11.4
6.11.5
6.11.6
6.12.0
6.12.1
6.12.2
6.12.4
6.12.5
6.12.6
6.12.7
6.12.8
6.12.9
6.13.0
6.13.1
6.13.2
6.13.3
6.13.4
6.13.5
6.13.6
7.*
7.0.0
7.6.10
7.6.11
7.6.12
7.6.13
7.6.4
7.6.5
7.6.6
7.6.7
7.6.8
7.6.9
7.7.0
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.1.0
8.1.1
8.1.2
8.1.3
8.2.0
8.2.1
8.2.2
8.2.3
8.2.4
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.4.1
8.4.2
8.4.3
8.4.4
8.4.5
8.5.0
8.5.1
8.5.2
8.5.3
8.5.4
8.5.5
8.6.0
8.6.1
8.6.2
8.6.3
8.6.4
8.7.0
8.7.1
8.7.2
8.7.3
8.8.0
8.8.1
8.8.2
8.8.3
8.8.4
8.9.0
8.9.1
8.9.2
8.9.3
8.9.4