Is mongoose safe ? 9 known vulnerabilities, worst severity CRITICAL.
// reach 25 direct dependencies
7 carry known advisories, worst CRITICAL
141 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 94th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-vg7j-7cwx-8wgw, the advisory selected below
// 9 advisories GHSA-vg7j-7cwx-8wgw Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data. CRIT GHSA-9m93-w8w6-76hh Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20. CRIT GHSA-h8hf-x3f4-xwgp Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. CRIT GHSA-8687-vv9j-hgph Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-b CRIT GHSA-wpg9-53fq-2r8h This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. HIGH GHSA-m7xq-9374-9rvx Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data. HIGH GHSA-f825-f98c-gj3g Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack. HIGH GHSA-664h-wqgq-64gw What kind of vulnerability is it? Who is impacted? MODE GHSA-r5xw-q988-826m Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. MODE Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.
NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High Checked 2026-11-06 at 19:19 UTC. The most recent advisory here was published 2026-07-24. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page