What’s Vulnerable › Vulnerabilities

CVE-2024-53900

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-12-02 · updated 2026-06-17
• Weakness: CWE-89

Description

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

Affected products

• automattic/mongoose: before 6.13.5; from 7.0.1 before 7.8.3; from 8.0.1 before 8.8.3; 7.0.0-rc0, 8.0.0-rc0 — fixed in 6.13.5, 7.8.3, 8.8.3

How to fix

Upgrade to a fixed version: automattic/mongoose 6.13.5, 7.8.3, 8.8.3. Check the vendor advisory for mitigations.

References

• https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md
• https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156
• https://github.com/Automattic/mongoose/releases
• https://github.com/advisories/GHSA-m7xq-9374-9rvx
• https://www.npmjs.com/package/mongoose?activeTab=versions

Get alerted when CVE-2024-53900 or the next vulnerability affects your stack