PkgSeer

Vulnerability GHSA-pcrw-h46h-c93h

Critical

9 hours ago

Mongoose: sanitizeFilter not applied on countDocuments

<6.13.11, >=7.0.0 <7.8.12, >=8.0.0 <8.24.3, >=9.0.0 <9.9.2

Summary

Mongoose: sanitizeFilter not applied on countDocuments

Details

Impact

sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments() queries.

Patches

Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using.

^9.9.2
^8.24.3
^7.8.12
^6.13.11

Workarounds

Middleware:

mongoose.plugin(function() {
  schema.pre('countDocuments', function() {
    // This will always apply `sanitizeFilter` on `countDocuments`
    mongoose.sanitizeFilter(this.getFilter());
  });
});

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections

<6.13.12, >=7.0.0 <7.8.13, >=8.0.0 <8.24.7, >=9.0.0 <9.11.4 GHSA-wr5m-5jph-8m96

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

<6.13.12, >=7.0.0 <7.8.13, >=8.0.0 <8.24.7, >=9.0.0 <9.11.4 GHSA-8332-j7wj-wjw4

Mongoose: Prototype pollution via Schema.prototype.virtual()

<6.13.12, >=7.0.0 <7.8.13, >=8.0.0 <8.24.7, >=9.0.0 <9.11.4 GHSA-6972-9mcm-vhwj

Mongoose: Connection-level sanitizeFilter not applied

>=6.0.0 <6.13.12, >=7.0.0 <7.8.13, >=8.0.0 <8.24.7, >=9.0.0 <9.11.4 GHSA-gg4r-jv3p-qx3c

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

<6.13.10, >=7.0.0 <7.8.10, >=8.0.0 <8.24.1, >=9.0.0 <9.7.2 GHSA-664h-wqgq-64gw

View all vulnerabilities for these packages

Impacted packages

mongoose

Timeline

Published

9 hours ago

Fixed (9.9.2)

3 months ago

Fixed (8.24.3)

3 months ago

Fixed (7.8.12)

3 months ago

Fixed (6.13.11)

3 months ago

Last Modified

9 hours ago