Critical severity9.1NVD Advisory· Published Dec 2, 2024· Updated Jun 17, 2026
CVE-2024-53900
CVE-2024-53900
Description
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mongoosenpm | >= 8.0.0-rc0, < 8.8.3 | 8.8.3 |
mongoosenpm | >= 7.0.0-rc0, < 7.8.3 | 7.8.3 |
mongoosenpm | >= 6.0.0-rc0, < 6.13.5 | 6.13.5 |
mongoosenpm | >= 3.6.0-rc0, < 5.13.23 | 5.13.23 |
Affected products
6cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*+ 2 more
- cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*range: <6.13.5
- cpe:2.3:a:mongoosejs:mongoose:7.0.0:rc0:*:*:*:node.js:*:*
- cpe:2.3:a:mongoosejs:mongoose:8.0.0:rc0:*:*:*:node.js:*:*
- Mongoose/Mongoosedescription
- osv-coords2 versions
< 6.13.5+ 1 more
- (no CPE)range: < 6.13.5
- (no CPE)range: >= 8.0.0-rc0, < 8.8.3
Patches
Vulnerability mechanics
References
13- github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156nvdPatchWEB
- github.com/advisories/GHSA-m7xq-9374-9rvxnvdVendor AdvisoryADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-53900ghsaADVISORY
- github.com/Automattic/mongoose/blob/master/CHANGELOG.mdnvdRelease NotesWEB
- github.com/Automattic/mongoose/commit/33679bcf8ca43d74e3e8ecd4cc224826772d805bghsaWEB
- github.com/Automattic/mongoose/commit/bbb6fa7ecb44bbaf5bea955d886378a1247bce0bghsaWEB
- github.com/Automattic/mongoose/compare/6.13.4...6.13.5ghsaWEB
- github.com/Automattic/mongoose/compare/7.8.2...7.8.3ghsaWEB
- github.com/Automattic/mongoose/compare/8.8.2...8.8.3ghsaWEB
- github.com/Automattic/mongoose/releasesnvdRelease NotesWEB
- github.com/github/advisory-database/pull/6769ghsaWEB
- github.com/github/advisory-database/pull/6776ghsaWEB
- www.npmjs.com/package/mongoosenvdProductWEB
News mentions
0No linked articles in our index yet.