TI-2026-30638 CVE-2026-42334 · GHSA-wpg9-53fq-2r8h
Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Priority LOW 39
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.
Vulnerabilities
6 records
TI-2025-16870 CVE-2025-23061 · GHSA-vg7j-7cwx-8wgw
Code injection in mongoosejs Mongoose
Priority MEDIUM 53
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.
TI-2024-36076 CVE-2024-53900 · GHSA-m7xq-9374-9rvx
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
Priority MEDIUM 54
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
TI-2023-03453 CVE-2023-3696 · GHSA-9m93-w8w6-76hh
Prototype Pollution in automattic/mongoose
Priority HIGH 81
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
TI-2022-02368 CVE-2022-2564 · GHSA-f825-f98c-gj3g
Prototype Pollution in automattic/mongoose
Priority HIGH 75
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
TI-2019-13012 CVE-2019-17426 · GHSA-8687-vv9j-hgph
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some…
Priority MEDIUM 42
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored.