| Package | Affected versions | Patched versions |
|---|---|---|
| mongoose | = 7.0.0= 8.0.0≥ 7.0.1, < 7.8.3≥ 8.0.1, < 8.8.3< 6.13.5 | 7.8.38.8.36.13.5 |
| mongoose | ≥ 3.6.0-rc0, < 5.13.23≥ 6.0.0-rc0, < 6.13.5≥ 7.0.0-rc0, < 7.8.3≥ 8.0.0-rc0, < 8.8.3 | 5.13.236.13.57.8.38.8.3 |
Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free