Homepage

mongoose@8.9.3 vulnerabilities

Mongoose MongoDB ODM

  • latest version

    8.9.5

  • latest non vulnerable version

    8.9.5

  • first published

    14 years ago

  • latest version published

    8 days ago

  • licenses detected

  • View mongoose package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mongoose package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Improper Neutralization of Special Elements in Data Query Logic

    mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

    Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper use of a $where filter in conjunction with the populate() match. An attacker can manipulate search queries to retrieve or alter information without proper authorization by injecting malicious input into the query.

    Note: This vulnerability derives from an incomplete fix of CVE-2024-53900

    How to fix Improper Neutralization of Special Elements in Data Query Logic?

    Upgrade mongoose to version 6.13.6, 7.8.4, 8.9.5 or higher.

    <6.13.6>=7.0.0 <7.8.4>=8.0.0 <8.9.5
    Go back to all versions of this package