CVE-2024-53900

Mongoose versions before 8.8.3 are vulnerable to NoSQL injection because the software improperly handles the $where operator within match queries. This flaw allows unauthenticated attackers to execute arbitrary JavaScript code on the MongoDB server, potentially leading to Remote Code Execution (R...