CVE-2025-23061

CVE-2025-23061 - Mongoose 命令注入 针对 Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 与 CVE-2025-23061 时间线 2024年11月7日: Dat Phung 在 Mongoose 中发现了一个严重漏洞，并向 Snyk 提交了安全报告。 2024年11月26日: Mongoose 发布版本 8.8.3 以修复该漏洞。 2024年12月2日: 国家漏洞数据库 NVD 针对该漏洞披露了 CVE-2024-53900。 2024年12月17日: 在分析 Mongoose 8.8.3 补丁后，Dat Phung...

Mongoose - NoSQL Injection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where 远程代码执行（RCE） 本仓库提供了一个可复现的漏洞环境及针对 CVE-2024-53900 的概念验证（PoC），该漏洞是 Mongoose 8.8.3 中的一个严重远程代码执行（RCE）漏洞。 📌 漏洞详情 CVE : CVE-2024-53900 受影响的版本 : Mongoose 8.8.3 严重性 : 严重（CVSS 9.1） 攻击向量 : populate.match 与 $where 结合 影响 : 在 Node.js 环境中执行任意 JavaScript（RCE） 参考资料:...

BIT-MONGOOSE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

Exploit for CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where RCE This r...

Search Injection

Mongoose is vulnerable to Search Injection. The vulnerability is due to improper handling of a nested $where filter with a populate match, allows the improper handling of a nested $where filter with a populate match, which can be exploited for search injection attacks...

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

PT-2025-4804

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.9.5 Mongoose versions prior to 7.8.4 Mongoose versions prior to 6.13.6 Description Mongoose is susceptible to a search injection issue due to the improper handling of nested $where filters when used with populate...