Search for packages
| purl | pkg:npm/mongoose@7.0.0-rc0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-bu2j-qbnd-27ct
Aliases: CVE-2024-53900 GHSA-m7xq-9374-9rvx |
Mongoose search injection vulnerability Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-wf9k-8mhk-1fe1
Aliases: CVE-2025-23061 GHSA-vg7j-7cwx-8wgw |
Mongoose search injection vulnerability Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the `$where` operator. This vulnerability arises from the ability of the `$where` clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-04T16:23:04.216909+00:00 | GitLab Importer | Affected by | VCID-wf9k-8mhk-1fe1 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/mongoose/CVE-2025-23061.yml | 38.6.0 |
| 2026-06-04T16:22:46.616107+00:00 | GitLab Importer | Affected by | VCID-bu2j-qbnd-27ct | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/mongoose/CVE-2024-53900.yml | 38.6.0 |