CVE-2024-53900: Mongoose search injection vulnerability
(updated )
Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.
References
- github.com/Automattic/mongoose
- github.com/Automattic/mongoose/blob/master/CHANGELOG.md
- github.com/Automattic/mongoose/commit/33679bcf8ca43d74e3e8ecd4cc224826772d805b
- github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156
- github.com/Automattic/mongoose/compare/6.13.4...6.13.5
- github.com/Automattic/mongoose/compare/7.8.2...7.8.3
- github.com/Automattic/mongoose/compare/8.8.2...8.8.3
- github.com/Automattic/mongoose/releases
- github.com/advisories/GHSA-m7xq-9374-9rvx
- nvd.nist.gov/vuln/detail/CVE-2024-53900
- www.npmjs.com/package/mongoose?activeTab=versions
Code Behaviors & Features
Detect and mitigate CVE-2024-53900 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →