TI-2023-03453 CVE-2023-3696 · GHSA-9m93-w8w6-76hh
Prototype Pollution in automattic/mongoose
Priority HIGH 81
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
mongoosejs
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
mongoosejs records in CISA KEVNo mongoosejs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Mongoose · all components
TI-2022-02368 CVE-2022-2564 · GHSA-f825-f98c-gj3g
Prototype Pollution in automattic/mongoose
Priority HIGH 75
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
TI-2024-36076 CVE-2024-53900 · GHSA-m7xq-9374-9rvx
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
Priority MEDIUM 54
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
TI-2025-16870 CVE-2025-23061 · GHSA-vg7j-7cwx-8wgw
Code injection in mongoosejs Mongoose
Priority MEDIUM 53
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.
TI-2019-13012 CVE-2019-17426 · GHSA-8687-vv9j-hgph
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some…
Priority MEDIUM 42
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored.
TI-2026-30638 CVE-2026-42334 · GHSA-wpg9-53fq-2r8h
Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Priority LOW 39
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.