Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2024-53900 — CRITICAL severity vulnerability | Release Alert

CVE-2024-53900

9.1

CRITICALCVSS v3

Published

December 2, 2024

Affected

8 projects

Assigned by

MITRE

Severity scale

010

Description

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

NPMMongoose MongoDB ODM

< 6.13.5, >= 7.0.1, < 7.8.3, >= 8.0.1, < 8.8.3, = 7.0.0, = 8.0.0NVD

@types/mongoose

NPMStub TypeScript definitions entry for mongoose, which provides its own types definitions

< 6.13.5, >= 7.0.1, < 7.8.3, >= 8.0.1, < 8.8.3, = 7.0.0, = 8.0.0NVD

@bakjs/mongoose

More on this CVE

NVD↗GitHub Advisory↗

NPM

< 6.13.5, >= 7.0.1, < 7.8.3, >= 8.0.1, < 8.8.3, = 7.0.0, = 8.0.0NVD

cesanta/mongoose

GitHubEmbedded web server, with TCP/IP network stack, MQTT and Websocket

< 6.13.5, >= 7.0.1, < 7.8.3, >= 8.0.1, < 8.8.3, = 7.0.0, = 8.0.0NVD

Automattic/mongoose

GitHubMongoDB object modeling designed to work in an asynchronous environment.

< 6.13.5, >= 7.0.1, < 7.8.3, >= 8.0.1, < 8.8.3, = 7.0.0, = 8.0.0NVD

Python Package IndexEating all the snakes.

< 6.13.5, >= 7.0.1, < 7.8.3, >= 8.0.1, < 8.8.3, = 7.0.0, = 8.0.0NVD

Crates.ioConvenient MongoDb Wrappers

< 6.13.5, >= 7.0.1, < 7.8.3, >= 8.0.1, < 8.8.3, = 7.0.0, = 8.0.0NVD

RubyGemsMongoose is a module that allows you to create and databases. It has an ActiveRecord-like interface, uses Skiplists for its indexing, and uses Marshal to serializeits data.

< 6.13.5, >= 7.0.1, < 7.8.3, >= 8.0.1, < 8.8.3, = 7.0.0, = 8.0.0NVD