{"action":"Upgrade mongoose to 5.13.23 or later.","affected":[{"fixed":"8.8.3","introduced":"8.0.0-rc0"},{"fixed":"7.8.3","introduced":"7.0.0-rc0"},{"fixed":"6.13.5","introduced":"6.0.0-rc0"},{"fixed":"5.13.23","introduced":"3.6.0-rc0"}],"component":"mongoose","cve_ids":["CVE-2024-53900"],"ecosystem":"npm","epss":0.03981,"exploited":false,"fixed_versions":["8.8.3","7.8.3","6.13.5","5.13.23"],"ghsa_id":"GHSA-m7xq-9374-9rvx","id":"tcs_01M5KG02E3K1RSNXJTF4HQ90CD","modified_at":"2026-02-05T00:01:59.584013Z","published_at":"2024-12-02T21:31:20Z","references":["https://osv.dev/vulnerability/GHSA-m7xq-9374-9rvx","https://nvd.nist.gov/vuln/detail/CVE-2024-53900","https://github.com/github/advisory-database/pull/6769","https://github.com/github/advisory-database/pull/6776","https://github.com/Automattic/mongoose/commit/33679bcf8ca43d74e3e8ecd4cc224826772d805b","https://github.com/Automattic/mongoose/commit/bbb6fa7ecb44bbaf5bea955d886378a1247bce0b","https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156","https://github.com/Automattic/mongoose","https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md","https://github.com/Automattic/mongoose/compare/6.13.4...6.13.5","https://github.com/Automattic/mongoose/compare/7.8.2...7.8.3","https://github.com/Automattic/mongoose/compare/8.8.2...8.8.3","https://github.com/Automattic/mongoose/releases","https://www.npmjs.com/package/mongoose?activeTab=versions"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-m7xq-9374-9rvx","url":"https://osv.dev/vulnerability/GHSA-m7xq-9374-9rvx"}],"summary":"Mongoose search injection vulnerability"}