Mongoose < 8.8.3 - Remote Code Execution

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...

VulnCheck KEV: CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

Security Bulletin: Mongoose Improper Handling of Nested $where in populate() Match Allows Search Injection

Summary Mongoose improper handling of nested $where in populate match allows search injection due to incomplete fix for CVE-2024-53900. Vulnerability Details CVEID:CVE-2025-23061 DESCRIPTION: Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search...

Security Bulletin: Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

Summary Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Vulnerability Details CVEID:CVE-2024-53900 DESCRIPTION: Mongoose before 8.8.3 can improperly use $where in match. CWE:CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Mongoose

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Mongoose Vulnerability Details CVEID:CVE-2024-53900 DESCRIPTION: Mongoose before 8.8.3 can improperly use $where in match. CWE:CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CVSS...

Exploit for CVE-2024-53900

CTF Challenge - Mongoose RCE CVE-2024-53900 Challenge Overvie...

Mongoose search injection vulnerability

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access...

CVE-2025-23061

CVE-2025-23061 affects Mongoose before 8.9.5, enabling search injection via a nested $where filter in populate() match. This builds on an incomplete fix for CVE-2024-53900, as evidenced by multiple connected documents (Nuclei template, IBM security bulletins, and IBM/CVE details) describing NoSQL...

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

CVE-2024-53900

creationtimestamp| type| source ---|---|--- 2024-12-02 22:06:16+00:00| seen| https://t.me/cvedetector/11816 2025-01-15 04:32:10+00:00| seen| https://infosec.exchange/users/cve/statuses/113830496154420562 2025-01-15 05:11:26+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/1700 2025-01-15...

1405-authtokens (>=1.0.1, <=1.0.5), 1405_logging (1.0.0) +4123 more potentially affected by CVE-2024-53900 via mongoose (>=3.6.2, <=5.13.22)

mongoose NPM version =3.6.2, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.3.5, =0.2.0, =0.0.1, =1.0.16, =1.0.30, =1.0.95 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

@3kles/3kles-coremongodb (>=2.1.5, <=2.1.6), @akemona-org/strapi-connector-mongoose (>=3.13.0, <=3.16.2) +96 more potentially affected by CVE-2024-53900 via mongoose (>=8.0.0, <=8.8.2)

mongoose NPM version =8.0.0, =2.1.5, =3.13.0, =2.0.0, =0.0.34, =0.5.0, =0.4.3, =0.4.5, =0.4.12, =4.1.5, =1.3.5, =0.0.5, =0.2.1, =8.3.1, =4.8.0, =1.0.0, =1.2.2 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +111 more potentially affected by CVE-2024-53900 via mongoose (>=7.0.0, <=7.8.2)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =1.0.9 - @dedel.alex/adonis5-mongoose 7.6.10 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +414 more potentially affected by CVE-2024-53900 via mongoose (>=6.0.1, <=6.13.4)

mongoose NPM version =6.0.1, =1.2.3, =2.0.1, =0.0.1-alpha.89, =0.0.1-alpha.89, =0.0.3, =1.0.5, =3.9.0, =1.0.9, =1.0.0-beta1, =1.4.5, =1.1.80, =0.0.1, =0.1.16 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

CVE-2024-53900

CVE-2024-53900 affects Mongoose. Before 8.8.3, it can improperly use $where in match, causing NoSQL injection with potential remote code execution (RCE). CVSS is 3.1 base 9.1 (CRITICAL). Mitigation: upgrade Mongoose to 8.8.3 or later; some sources describe continued risk due to incomplete fixes f...