# CVE-2024-53900: Mongoose search injection vulnerability via $where operator

Source: https://junglewise.ai/threats/cve-2024-53900-mongoose-search-injection-vulnerability-via-where-operator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-53900 · Severity: low · CVSS 3.1 · Published 2024-12-02

Mongoose, a popular MongoDB object modeling library for Node.js, contains a vulnerability in how it handles the $where operator in database queries. Attackers can inject arbitrary JavaScript code that gets executed in MongoDB queries, potentially allowing them to read, modify, or delete database contents. Applications using affected versions of Mongoose to process user-supplied search filters are at risk of code injection and unauthorized data access.

Technologies: [mongoose (npm)](https://junglewise.ai/threats/technologies/mongoose). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-53900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-53900 being exploited in the wild.

**How severe is CVE-2024-53900?** Low severity, with a CVSS score of 3.1, published 2 December 2024.

**Which products and versions are affected?** mongoose (npm) SEMVER:introduced=8.0.0-rc0,fixed=8.8.3.

**Is there a fix for CVE-2024-53900?** Yes. mongoose (npm): upgrade to 8.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-53900 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-53900?** Check whether you run mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mongoose (npm): upgrade to 8.8.3 or later

  ```sh
  npm install mongoose@8.8.3
  ```


## Technical details

This is a code injection vulnerability (CWE-89) arising from improper handling of the MongoDB $where operator in Mongoose query filters, particularly in the populate() method. The $where operator allows arbitrary JavaScript code execution within MongoDB queries. Versions prior to 3.6.0-rc0 are unaffected; the vulnerability was introduced in 3.6.0-rc0 and affects all subsequent versions until the respective patch releases. No authentication or user interaction is required—an attacker with network access to an application can supply malicious $where clauses through user input (search parameters, API payloads, etc.) to execute arbitrary JavaScript in the MongoDB context, compromising confidentiality, integrity, and availability of database data. Patches are available in versions 8.8.3, 7.8.3, 6.13.5, and 5.13.23.

## Affected products

- Automattic Mongoose Prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23

## Identifiers

- CVE-2024-53900
- GHSA-m7xq-9374-9rvx

## Timeline

- 2024-12-02: disclosed
- 2024-12-02: patched: Versions 8.8.3, 7.8.3, 6.13.5, and 5.13.23 released with fixes

## Related threats

- [Mongoose sanitizeFilter not applied on countDocuments](https://junglewise.ai/threats/cve-2026-125120-mongoose-sanitizefilter-not-applied-on-countdocuments)
- [Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.](https://junglewise.ai/threats/cve-2026-125119-mongoose-connection-level-sanitizefilter-not-applied)
- [Mongoose prototype pollution in Schema.prototype.virtual()](https://junglewise.ai/threats/cve-2026-125118-mongoose-prototype-pollution-via-schema-prototype-virtual)
- [Mongoose prototype pollution in object initialization](https://junglewise.ai/threats/cve-2026-125117-mongoose-is-a-mongodb-object-modeling-tool-designed-to-work-in)
- [Mongoose discriminator key inheritance bypass](https://junglewise.ai/threats/cve-2026-125116-mongoose-discriminator-key-values-matching-inherited-properties)