{"id":"CVE-2026-125120","published":"2026-11-09T23:17:22.587","lastModified":"2026-11-09T23:17:22.587","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-943"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a","tags":[]},{"url":"https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557","tags":[]},{"url":"https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d","tags":[]},{"url":"https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710","tags":[]},{"url":"https://github.com/Automattic/mongoose/releases/tag/6.13.11","tags":[]},{"url":"https://github.com/Automattic/mongoose/releases/tag/7.8.12","tags":[]},{"url":"https://github.com/Automattic/mongoose/releases/tag/8.24.3","tags":[]},{"url":"https://github.com/Automattic/mongoose/releases/tag/9.9.2","tags":[]},{"url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h","tags":[]}],"exploitRefs":[{"url":"https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a","tags":[]},{"url":"https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557","tags":[]},{"url":"https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d","tags":[]},{"url":"https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710","tags":[]},{"url":"https://github.com/Automattic/mongoose/releases/tag/6.13.11","tags":[]},{"url":"https://github.com/Automattic/mongoose/releases/tag/7.8.12","tags":[]},{"url":"https://github.com/Automattic/mongoose/releases/tag/8.24.3","tags":[]},{"url":"https://github.com/Automattic/mongoose/releases/tag/9.9.2","tags":[]},{"url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h","tags":[]}],"hasPoc":true,"ai":{"summary":"Mongoose's countDocuments() function fails to sanitize attacker-controlled filter inputs when sanitizeFilter is enabled, allowing query operator injection. This lets attackers manipulate the count result by injecting operators like $gt or $ne as literal values, potentially bypassing authorization checks or business logic that relies on accurate document counts.","exploitability":"Exploitation requires an application to explicitly enable sanitizeFilter and pass unsanitized user input directly to countDocuments(); no authentication is needed if the endpoint is publicly exposed.","blast_radius":"Successful exploitation could lead to unauthorized data access, privilege escalation via incorrect count-based authorization, or disruption of rate-limiting and quota enforcement mechanisms.","remediation":"Upgrade Mongoose to version 6.13.11, 7.8.12, 8.24.3, or 9.9.2 (or later patch for the respective major line) immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["injection","auth-bypass","mongodb","nodejs"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:44:40.391Z"}}