| Package | Affected versions | Patched versions |
|---|---|---|
| mongoose | ≥ 7.0.0, < 7.8.4≥ 8.0.0, < 8.9.5< 6.13.6 | 7.8.48.9.56.13.6 |
| mongoose | ≥ 7.0.0-rc0, < 7.8.4≥ 8.0.0-rc0, < 8.9.5< 6.13.6 | 7.8.48.9.56.13.6 |
Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.
NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free