Mongoosejs: >> Mongoose >> 8.9.0 Security Vulnerabilities
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
CVSS Score
9.0
EPSS Score
0.62
Published
2025-01-15