CVE-2025-23061: $where operator vulnerability in mongoose (npm)

What is CVE-2025-23061 About?

This vulnerability in Mongoose, present in versions prior to 8.9.5, 7.8.4, and 6.13.6, is due to the improper use of the $where operator. It allows for arbitrary JavaScript code execution in MongoDB queries, potentially leading to code injection attacks and unauthorized data manipulation. This is an incomplete fix for a previous vulnerability, indicating a continued risk and ease of exploitation if parameters are not properly sanitized.

Affected Software

mongoose
- >8.0.0-rc0, <8.9.5
- >7.0.0-rc0, <7.8.4
- <6.13.6

Technical Details

This vulnerability is an incomplete fix for CVE-2024-53900 and similarly arises from the MongoDB $where operator's capability to execute arbitrary JavaScript code. In the affected Mongoose versions, if unsanitized or inadequately sanitized user input is used to construct a $where clause, an attacker can inject malicious JavaScript. This injected code will be executed by the MongoDB server as part of the query processing. The flaw indicates that the previous remediation for CVE-2024-53900 did not fully address all potential input vectors or contexts where user input could bypass controls and reach the $where operator in an unescaped manner, thereby reintroducing the code injection vulnerability.

What is the Impact of CVE-2025-23061?

Successful exploitation may allow attackers to execute arbitrary code within the database context, leading to unauthorized access, modification, or deletion of sensitive data, and potentially a full compromise of the database system.

What is the Exploitability of CVE-2025-23061?

Exploitation of this vulnerability involves providing malicious input to a vulnerable MongoDB query utilizing the $where operator, bypassing the incomplete fix for CVE-2024-53900. The complexity is medium, as it requires crafting specific payloads that exploit the lingering weaknesses. Authentication requirements are dependent on whether the input point is accessible pre-authentication or requires a valid session. Privilege requirements are minimal beyond the ability to interact with the application in a way that influences database queries. This can be exploited remotely if the application is publicly accessible. Risk factors include applications that still do not adequately sanitize user input before it is incorporated into MongoDB $where clauses, despite attempts to patch such vulnerabilities.

What are the Known Public Exploits?

PoC Author	Link	Commentary
No known exploits

What are the Available Fixes for CVE-2025-23061?

A Fix by Resolved Security Exists!

See how we help you strengthen security with automated backported fixes for your libraries.

About the Fix from Resolved Security

This patch introduces the throwOn$where function to recursively reject any use of the $where operator in populate() query matches, rather than only detecting $where at the top level. This fix comprehensively mitigates CVE-2025-23061, preventing attackers from injecting malicious JavaScript via nested $where filters in population queries, thereby closing a critical sandbox escape vector.

Available Upgrade Options

mongoose
- <6.13.6 → Upgrade to 6.13.6
mongoose
- >7.0.0-rc0, <7.8.4 → Upgrade to 7.8.4
mongoose
- >8.0.0-rc0, <8.9.5 → Upgrade to 8.9.5

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2025-23061?

Similar Vulnerabilities: CVE-2024-53900 , CVE-2012-6634 , CVE-2013-4660 , CVE-2013-6858 , CVE-2015-0205

CVE-2025-23061 $where operator vulnerability in mongoose (npm)