CVE-2025-23061
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Analysis
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with populate() match operations. This is an incomplete fix for CVE-2024-53900, allowing attackers to inject arbitrary MongoDB queries through SpEL-like expressions in nested query parameters.
Technical Context
Mongoose's populate() method supports match conditions for filtering populated documents. When a $where filter is nested within a populate match, the query sanitization from the original CVE-2024-53900 fix is bypassed. An attacker can inject arbitrary JavaScript that executes in MongoDB's query context, enabling data extraction or server-side JavaScript execution.
Affected Products
['Mongoose < 8.9.5', 'Node.js applications using Mongoose populate() with user-controlled match']
Remediation
Update Mongoose to 8.9.5 or later. Never pass unsanitized user input to populate match conditions. Implement query parameter allowlisting. Disable JavaScript execution in MongoDB if not required (--noscripting).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today