Affected: Bitnami: mongoose

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

Affected: npm: mongoose

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.