mongoose < 6.13.6 and 8.0.0-rc0-8.9.5 - Search Injection via Nested $where Filter with Populate Match
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2025-23061. PoCs published by amikanev, open-flaw, dajneem23. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2025-23061, demonstrating a NoSQL injection vulnerability in a Node.js application using MongoDB. The exploit leverages improper JSON parsing in query parameters to manipulate MongoDB queries, allowing unauthorized data access or manipulation.
Description
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Exploits (3)
This repository contains a functional PoC for CVE-2025-23061, demonstrating a NoSQL injection vulnerability in a Node.js application using MongoDB. The exploit leverages improper JSON parsing in query parameters to manipulate MongoDB queries, allowing unauthorized data access or manipulation.
This repository contains a functional exploit for CVE-2025-23061, demonstrating a NoSQL injection vulnerability in Mongoose's `populate()` function. The exploit bypasses the incomplete fix for CVE-2024-53900 by nesting `$where` operators within logical operators like `$and` or `$or`.
This repository contains a functional proof-of-concept exploit for CVE-2025-23061, demonstrating command injection in Mongoose via nested `$where` operators in the `populate()` function's match option. The exploit includes examples for information disclosure, authentication bypass, and DoS attacks.
Nuclei Templates (1)
title:"Mongoose"
title="Mongoose"
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H