High severity - Improper Neutralization of Special Elements in Data Query Logic vulnerability in mongoose (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: mongoose
• Introduced through: [email protected] and [email protected]

Detailed paths

• Introduced through: [email protected] › [email protected]

Overview

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper handling of $where in match queries. An attacker can manipulate search queries to inject malicious code.

Remediation

Upgrade mongoose to version 6.13.5, 7.8.3, 8.8.3 or higher.

References

• GitHub Commit
• GitHub Commit
  
  SNYK-JS-MONGOOSE-8446504
  (CVE-2024-53900) [email protected]