← Database

CVE-2024-53900

CRITICAL CVSS: 9.1 Published: 2024-12-02 Modified: 2026-06-17

Description

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

Affected Platforms

Mongoosejs Mongoose

Weakness Type

CWE-89

References