Mongoosejs: >> Mongoose >> 5.10.5 Security Vulnerabilities
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
CVSS Score
9.0
EPSS Score
0.624
Published
2025-01-15
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
CVSS Score
9.1
EPSS Score
0.644
Published
2024-12-02
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
CVSS Score
10.0
EPSS Score
0.005
Published
2023-07-17
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
CVSS Score
7.0
EPSS Score
0.029
Published
2022-07-28