Threats tagged 'ghsa-gg4r-jv3p-qx3c'

Mongoose versions from 6.0.0 up to but not including 6.13.12, 7.0.0 up to 7.8.13, 8.0.0 up to 8.24.7, and 9.0.0 up to 9.11.4 have a vulnerability where the connection-level sanitizeFilter option is not applied. This option is intended to prevent query selector injection by wrapping operator objects in filters to match them literally. Due to a coding mismatch, the sanitizeFilter setting is reported as enabled but does not actually sanitize queries, allowing attackers to bypass this protection. The vulnerability does not affect users who set sanitizeFilter globally or on specific queries. A fix is available in later versions.