CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2024-53900
Critical (9.1) in mongoosejs mongoose. EPSS 4.0% chance of exploitation in the next 30 days. Fixed in mongoose 5.13.23, 6.13.5, 7.8.3.
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
Severity
- EPSS
- 4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mongoosejs:mongoose
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m7xq-9374-9rvx | npm | mongoose | >=8.0.0-rc0 <8.8.3 | 8.8.3 |
| GHSA-m7xq-9374-9rvx | npm | mongoose | >=7.0.0-rc0 <7.8.3 | 7.8.3 |
| GHSA-m7xq-9374-9rvx | npm | mongoose | >=6.0.0-rc0 <6.13.5 | 6.13.5 |
| GHSA-m7xq-9374-9rvx | npm | mongoose | >=3.6.0-rc0 <5.13.23 | 5.13.23 |
References
- https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md
- https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156
- https://github.com/Automattic/mongoose/releases
- https://github.com/advisories/GHSA-m7xq-9374-9rvx
- https://www.npmjs.com/package/mongoose?activeTab=versions