CVE-2025-23061 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an inco…
Critical CVSS: 9.0

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Vendor
Mongoosejs
Product
Mongoose
CWE
CWE-94
Yayın Tarihi
2025-01-15 05:15:10
Güncelleme
2025-10-31 18:56:04
Source Identifier
cve@mitre.org
KEV Date Added
-

Kategoriler

CWE-94 Mongoose CRITICAL Mongoosejs 2025

Referanslar

https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc https://github.com/Automattic/mongoose/releases/tag/8.9.5 https://www.npmjs.com/package/mongoose?activeTab=versions