Every CVE Search/ Get API key

CVE-2025-23061

Mongoose search injection vulnerability

9.0 CriticalPublic exploitFix available

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

7.24%Up 7.2 points since Jan 15, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.0

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Record
CVE-2025-23061
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2025-0106 9.0

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Record
EUVD-2025-0106
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-vg7j-7cwx-8wgw 9.0

Mongoose search injection vulnerability

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Record
GHSA-vg7j-7cwx-8wgw
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
NVD 9.0

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Record
CVE-2025-23061
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 9.0

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Record
CVE-2025-23061
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-vg7j-7cwx-8wgw 9.0

Mongoose search injection vulnerability

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Record
GHSA-vg7j-7cwx-8wgw
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
Show 4 moreShow less
OSVBIT-mongoose-2025-23061 No score

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Record
BIT-mongoose-2025-23061
Updated
2026-11-02
OSVCLSA-2026-1774916722 No score

TuxCare security update for mongoose (1 CVE)

TuxCare rebuilt mongoose to address 1 CVE. Fixed in 5.13.23-tuxcare.1.

Record
CLSA-2026-1774916722
Updated
2026-11-02
OSVCLSA-2026-1777250310 No score

TuxCare security update for mongoose (1 CVE)

TuxCare rebuilt mongoose to address 1 CVE. Fixed in 6.12.2-tuxcare.2.

Record
CLSA-2026-1777250310
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2025-23061 No score

CVE-2025-23061 in mongoose - Patched by Root

Root has patched CVE-2025-23061 in the mongoose package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2025-23061
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mongoose
npm
 8.0.0-rc0 up to 8.9.5
8.9.5
mongoose
npm
 7.0.0-rc0 up to 7.8.4
7.8.4
mongoose
npm
 before 6.13.6
6.13.6
mongoose
Bitnami
 6.0.0 up to 6.13.6, 7.0.0 up to 7.8.4, 8.0.0 up to 8.9.5
6.13.67.8.48.9.5
mongoose
TuxCare:npm
 5.13.23-tuxcare.0 up to 5.13.23-tuxcare.1, plus listed versions
5.13.23
5.13.23-tuxcare.1
mongoose
TuxCare:npm
 6.12.2-tuxcare.0 up to 6.12.2-tuxcare.2, plus listed versions
6.12.26.12.2-tuxcare.1
6.12.2-tuxcare.2
mongoose
Root:npm
 before 5.13.23-aikido.1
5.13.23-aikido.16.9.1-aikido.26.9.1-aikido.36.9.1-aikido.4
@rootio/mongoose
Root:npm
 before 5.13.23-root.io.1
5.13.23-root.io.16.9.1-root.io.26.9.1-root.io.36.9.1-root.io.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiMongoose - NoSQL Injection
PoC in GitHubamikanev/CVE-2025-23061-LAB2026-04-06
PoC in GitHubopen-flaw/CVE-2025-230612025-12-11

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-23061 is a critical vulnerability (CVSS 9.0) in Automattic Mongoose, published January 15, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.24%, the 94th percentile. Fixed in mongoose 8.9.5.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open