CVE-2026-125120

The Mongoose MongoDB object modeling tool is vulnerable to a query selector injection issue in versions prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2 . The countDocuments() function fails to apply the configured sanitizeFilter defense, allowing an attacker to provide query operator objects that are...