CVE-2024-53900

Mongoose before version 8.8.3 is vulnerable to a critical NoSQL injection (CWE-89) due to the improper use of the $where operator in match queries. This flaw allows unauthenticated attackers to inject arbitrary JavaScript, potentially leading to Remote Code Execution (RCE) and unauthorized access...