← Database

CVE-2025-23061

CRITICAL CVSS: 9.0 Published: 2025-01-15 Modified: 2026-06-17

Description

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Affected Platforms

Mongoosejs Mongoose

Weakness Type

CWE-94

References