CVE-2026-125119

{
  "id": "CVE-2026-125119",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-09T23:17:22.397",
  "lastModified": "2026-11-09T23:17:22.397",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Automattic",
          "product": "mongoose",
          "versions": [
            {
              "version": ">= 6.0.0, < 6.13.12",
              "status": "affected"
            },
            {
              "version": ">= 7.0.0, < 7.8.13",
              "status": "affected"
            },
            {
              "version": ">= 8.0.0, < 8.24.7",
              "status": "affected"
            },
            {
              "version": ">= 9.0.0, < 9.11.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-943"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Automattic/mongoose/commit/4bb659478be2f30655a7bdd78bc251bdf111cd29",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/commit/4f4f9a79f860786a54133bee2c9af967ec691491",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/commit/83eda6af1489e9ef60bb8eee8cf9ee005771b9d5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/commit/b8970c25998c23fbccd17f76c0398b902ff4911d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/releases/tag/6.13.12",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/releases/tag/7.8.13",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/releases/tag/8.24.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/releases/tag/9.11.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c",
      "source": "[email protected]"
    }
  ]
}