https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 01:44:14 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-125119 <p>Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set(&#39;sanitizeFilter&#39;) and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.</p> <p>Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set(&#39;sanitizeFilter&#39;) and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.</p> https://db.gcve.eu/vuln/fkie_cve-2026-125119 https://db.gcve.eu/vuln/ghsa-gg4r-jv3p-qx3c <p><strong>Affected:</strong> npm: mongoose</p> <p>### Summary</p> <p>sanitizeFilter exists to stop query selector injection: it wraps operator objects such as `{ $ne: null }` in filter values in `$eq`, so they are matched literally. Set on a connection with `mongoose.connect()` or `createConnection(uri, { sanitizeFilter: true })`, the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to selector injection, and a password value of `{ $ne: null }` returns the account record without the password.</p> <p>### Details</p> <p>`NativeConnection#createClient()` at `lib/drivers/node-mongodb-native/connection.js:270-272` moves `options.sanitizeFilter` into `Connection.config` and deletes the original option. `Query#_castConditions()` at `lib/query.js:2413-2423` checks `Connection.options`, the global `options`, and the per-query options, but never `Connection.config`. The defense therefore does not run even though `Connection#get(&#39;sanitizeFilter&#39;)` returns true. This storage was introduced in Mongoose 6.0.0 and the same mismatch is present in 9.11.2.</p> <p>### Proof of concept</p> <p>```javascript import mongoose from &#39;mongoose&#39;</p> <p>const conn = await mongoose.createConnection(&#39;&lt;MONGODB_URI&gt;&#39;, { sanitizeFilter: true }).asPromise() const User = conn.model(&#39;User&#39;, new mongoose.Schema({ username: String, password: String, marker: String }))</p> <p>await User.create({ username: &#39;victim&#39;, password: &#39;correct-password&#39;, ma…</p> <p><strong>Affected:</strong> npm: mongoose</p> <p>### Summary</p> <p>sanitizeFilter exists to stop query selector injection: it wraps operator objects such as `{ $ne: null }` in filter values in `$eq`, so they are matched literally. Set on a connection with `mongoose.connect()` or `createConnection(uri, { sanitizeFilter: true })`, the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to selector injection, and a password value of `{ $ne: null }` returns the account record without the password.</p> <p>### Details</p> <p>`NativeConnection#createClient()` at `lib/drivers/node-mongodb-native/connection.js:270-272` moves `options.sanitizeFilter` into `Connection.config` and deletes the original option. `Query#_castConditions()` at `lib/query.js:2413-2423` checks `Connection.options`, the global `options`, and the per-query options, but never `Connection.config`. The defense therefore does not run even though `Connection#get(&#39;sanitizeFilter&#39;)` returns true. This storage was introduced in Mongoose 6.0.0 and the same mismatch is present in 9.11.2.</p> <p>### Proof of concept</p> <p>```javascript import mongoose from &#39;mongoose&#39;</p> <p>const conn = await mongoose.createConnection(&#39;&lt;MONGODB_URI&gt;&#39;, { sanitizeFilter: true }).asPromise() const User = conn.model(&#39;User&#39;, new mongoose.Schema({ username: String, password: String, marker: String }))</p> <p>await User.create({ username: &#39;victim&#39;, password: &#39;correct-password&#39;, ma…</p> https://db.gcve.eu/vuln/ghsa-gg4r-jv3p-qx3c