Packages / mongoose / Security

HighVulnerabilityGHSA-m7xq-9374-9rvxBIT-mongoose-2024-53900CVE-2024-53900Published 2 Dec 2024

Mongoose search injection vulnerability

Your version

Affected releases · mongoose

  • 8.x8.0.0 – 8.8.2Fixed in 8.8.3
  • 7.x7.0.0 – 7.8.2Fixed in 7.8.3
  • 6.x6.0.0 – 6.13.4Fixed in 6.13.5
  • 5.x5.0.0 – 5.13.22Fixed in 5.13.23
  • 4.x and older3.6.0 – 4.13.21No fix, no longer updated

On 8.x, the newest line:

npm install mongoose@8.8.3
Every release on a timeline
9.x

  1. Not affected

    9.0.0 – 9.11.4

    49 releases, latest

8.x

  1. Affected

    8.0.0 – 8.8.2

    44 releases

  2. Fixed

    8.8.3 – 8.24.7

    65 releases

7.x

  1. Affected

    7.0.0 – 7.8.2

    48 releases

  2. Fixed

    7.8.3 – 7.8.13

    11 releases

6.x

  1. Affected

    6.0.0 – 6.13.4

    114 releases

  2. Fixed

    6.13.5 – 6.13.12

    8 releases

5.x

  1. Affected

    5.0.0 – 5.13.22

    254 releases

  2. Fixed

    5.13.23

    1 release

4.x

  1. Affected

    4.0.0 – 4.13.21

    164 releases

3.x

  1. Not affected

    3.0.0 – 3.5.16

    30 releases

  2. Affected

    3.6.0 – 3.9.7

    74 releases

1016 stable releases of mongoose, oldest to newest, one row per major.

What happens

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.