CVE-2026-125119
HIGHAttack Surface
CVSS Vector Breakdown
Description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Weakness Classification (1)
Affected Software (8)
| Vendor | Product | Version |
|---|---|---|
| Automattic | mongoose | >= 6.0.0, < 6.13.12 |
| Automattic | mongoose | >= 7.0.0, < 7.8.13 |
| Automattic | mongoose | >= 8.0.0, < 8.24.7 |
| Automattic | mongoose | >= 9.0.0, < 9.11.4 |
| Automattic | mongoose | >= 6.0.0, < 6.13.12 |
| Automattic | mongoose | >= 7.0.0, < 7.8.13 |
| Automattic | mongoose | >= 8.0.0, < 8.24.7 |
| Automattic | mongoose | >= 9.0.0, < 9.11.4 |