{"action":"Upgrade mongoose to 6.13.6 or later.","affected":[{"fixed":"8.9.5","introduced":"8.0.0-rc0"},{"fixed":"7.8.4","introduced":"7.0.0-rc0"},{"fixed":"6.13.6","introduced":"0"}],"component":"mongoose","cve_ids":["CVE-2025-23061"],"ecosystem":"npm","epss":0.07236,"exploited":false,"fixed_versions":["8.9.5","7.8.4","6.13.6"],"ghsa_id":"GHSA-vg7j-7cwx-8wgw","id":"tcs_01M5KGBTNB2F4C3XFSHSQ08GNZ","modified_at":"2025-10-03T15:40:22Z","published_at":"2025-01-15T06:30:49Z","references":["https://osv.dev/vulnerability/GHSA-vg7j-7cwx-8wgw","https://nvd.nist.gov/vuln/detail/CVE-2025-23061","https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc","https://github.com/Automattic/mongoose","https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md","https://github.com/Automattic/mongoose/compare/6.13.5...6.13.6","https://github.com/Automattic/mongoose/compare/7.8.3...7.8.4","https://github.com/Automattic/mongoose/compare/8.9.4...8.9.5","https://github.com/Automattic/mongoose/releases/tag/6.13.6","https://github.com/Automattic/mongoose/releases/tag/7.8.4","https://github.com/Automattic/mongoose/releases/tag/8.9.5","https://github.com/advisories/GHSA-m7xq-9374-9rvx","https://www.npmjs.com/package/mongoose?activeTab=versions"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-vg7j-7cwx-8wgw","url":"https://osv.dev/vulnerability/GHSA-vg7j-7cwx-8wgw"}],"summary":"Mongoose search injection vulnerability"}