org.webjars.npm:mongoose 5.0.0-rc2 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:mongoose package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
H Improper Neutralization of Special Elements in Data Query Logic org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper use of a `$where` filter in conjunction with the `populate()` match. An attacker can manipulate search queries to retrieve or alter information without proper authorization by injecting malicious input into the query. Note: This vulnerability derives from an incomplete fix of CVE-2024-53900 How to fix Improper Neutralization of Special Elements in Data Query Logic? There is no fixed version for `org.webjars.npm:mongoose`.	[0,)
H Improper Neutralization of Special Elements in Data Query Logic org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper handling of `$where` in match queries. An attacker can manipulate search queries to inject malicious code. How to fix Improper Neutralization of Special Elements in Data Query Logic? A fix was pushed into the `master` branch but not yet published.	[0,)
H Prototype Pollution org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution in `document.js`, via update functions such as `findByIdAndUpdate()`. This allows attackers to achieve remote code execution. Note: Only applications using Express and EJS are vulnerable. How to fix Prototype Pollution? There is no fixed version for `org.webjars.npm:mongoose`.	[0,)
H Prototype Pollution org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution in the `Schema.path()` function. Note: CVE-2022-24304 is a duplicate of CVE-2022-2564. How to fix Prototype Pollution? There is no fixed version for `org.webjars.npm:mongoose`.	[0,)
M Prototype Pollution org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The `mongoose.Schema()` function is subject to prototype pollution due to the recursively calling of `Schema.prototype.add()` function to add new items into the schema object. This vulnerability allows modification of the Object prototype. PoC `mongoose = require('mongoose'); mongoose.version; //'5.12.0' var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}'; console.log('Before:', {}.polluted); // undefined mongoose.Schema(JSON.parse(malicious_payload)); console.log('After:', {}.polluted); // HACKED` How to fix Prototype Pollution? There is no fixed version for `org.webjars.npm:mongoose`.	[0,)
M Information Exposure org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Information Exposure. Any query object with a `_bsontype` attribute is ignored, allowing attackers to bypass access control. How to fix Information Exposure? Upgrade `org.webjars.npm:mongoose` to version 5.7.5 or higher.	[,5.7.5)

Vulnerability

Vulnerable Version

Improper Neutralization of Special Elements in Data Query Logic

org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper use of a $where filter in conjunction with the populate() match. An attacker can manipulate search queries to retrieve or alter information without proper authorization by injecting malicious input into the query.

Note: This vulnerability derives from an incomplete fix of CVE-2024-53900

How to fix Improper Neutralization of Special Elements in Data Query Logic?

There is no fixed version for org.webjars.npm:mongoose.

[0,)

Improper Neutralization of Special Elements in Data Query Logic

org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper handling of $where in match queries. An attacker can manipulate search queries to inject malicious code.

How to fix Improper Neutralization of Special Elements in Data Query Logic?

A fix was pushed into the master branch but not yet published.

[0,)

Prototype Pollution

org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in document.js, via update functions such as findByIdAndUpdate(). This allows attackers to achieve remote code execution.

Note: Only applications using Express and EJS are vulnerable.

How to fix Prototype Pollution?

There is no fixed version for org.webjars.npm:mongoose.

[0,)

Prototype Pollution

org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in the Schema.path() function.

Note: CVE-2022-24304 is a duplicate of CVE-2022-2564.

How to fix Prototype Pollution?

There is no fixed version for org.webjars.npm:mongoose.

[0,)

Prototype Pollution

org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The mongoose.Schema() function is subject to prototype pollution due to the recursively calling of Schema.prototype.add() function to add new items into the schema object. This vulnerability allows modification of the Object prototype.

PoC

mongoose = require('mongoose');
mongoose.version; //'5.12.0'
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mongoose.Schema(JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // HACKED

How to fix Prototype Pollution?

There is no fixed version for org.webjars.npm:mongoose.

[0,)

Information Exposure

org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Information Exposure. Any query object with a _bsontype attribute is ignored, allowing attackers to bypass access control.

How to fix Information Exposure?

Upgrade org.webjars.npm:mongoose to version 5.7.5 or higher.

[,5.7.5)

org.webjars.npm:mongoose@5.0.0-rc2 vulnerabilities

latest version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?

PoC