{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amongoosemongoose/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongoose:mongoose:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-125119"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mongoose (\u003e= 6.0.0, \u003c 6.13.12)","Mongoose (\u003e= 7.0.0, \u003c 7.8.13)","Mongoose (\u003e= 8.0.0, \u003c 8.24.7)","Mongoose (\u003e= 9.0.0, \u003c 9.11.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","database-security","injection","mongoose","mongodb"],"_cs_type":"advisory","_cs_vendors":["Mongoose"],"content_html":"\u003cp\u003eMongoose fails to apply the sanitizeFilter security option when configured at the connection level via \u003ccode\u003emongoose.connect()\u003c/code\u003e or \u003ccode\u003ecreateConnection()\u003c/code\u003e. While the connection reports the option as enabled, internal query casting logic fails to reference the configuration, rendering it ineffective. Applications relying on this setting to mitigate query selector injection remain vulnerable to attacks where malicious operators, such as \u003ccode\u003e{ $ne: null }\u003c/code\u003e, are passed into query filters. This issue affects Mongoose versions 6.x, 7.x, 8.x, and 9.x.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAttackers can bypass application-level authentication and data filtering by injecting MongoDB query operators into user-controlled input fields. For instance, passing an operator object as a password or username value can cause the database to return documents that should otherwise be restricted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Mongoose to a patched version: v6.13.12, v7.8.13, v8.24.7, or v9.11.4.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, shift from connection-level configuration to global or query-level sanitization:\u003c/li\u003e\n\u003cli\u003eUse global settings: \u003ccode\u003emongoose.set('sanitizeFilter', true)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUse query-level settings: \u003ccode\u003eModel.find().sanitizeFilter(true)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit existing application logic for dependencies on connection-level security configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T02:05:28Z","date_published":"2026-11-11T02:05:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter/","summary":"A bug in Mongoose allows MongoDB query selector injection due to the failure of connection-level sanitizeFilter configurations to apply, potentially enabling unauthorized record access.","title":"Mongoose: Connection-level sanitizeFilter bypass (CVE-2026-125119)","url":"https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongoose:mongoose:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-125120"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mongoose (\u003c 6.13.11)","mongoose (\u003e= 7.0.0, \u003c 7.8.12)","mongoose (\u003e= 8.0.0, \u003c 8.24.3)","mongoose (\u003e= 9.0.0, \u003c 9.9.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Mongoose"],"content_html":"\u003cp\u003eMongoose failed to apply the \u003ccode\u003esanitizeFilter\u003c/code\u003e security utility to \u003ccode\u003ecountDocuments()\u003c/code\u003e queries, which is designed to protect against query selector injection attacks. If an application passes unsanitized user-supplied input directly to the \u003ccode\u003ecountDocuments()\u003c/code\u003e filter argument, an attacker may be able to inject malicious query selectors. This vulnerability is identified as CVE-2026-125120.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow an attacker to alter the query logic of database operations, potentially resulting in unauthorized data exposure or information disclosure depending on how the application handles the query results.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade Mongoose to the following versions or later to ensure \u003ccode\u003esanitizeFilter\u003c/code\u003e is applied correctly to \u003ccode\u003ecountDocuments()\u003c/code\u003e queries:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to version ^9.9.2\u003c/li\u003e\n\u003cli\u003eUpgrade to version ^8.24.3\u003c/li\u003e\n\u003cli\u003eUpgrade to version ^7.8.12\u003c/li\u003e\n\u003cli\u003eUpgrade to version ^6.13.11\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eIf immediate upgrading is not possible, implement the provided middleware to enforce filtering on \u003ccode\u003ecountDocuments\u003c/code\u003e calls as a temporary mitigation.\u003c/p\u003e\n","date_modified":"2026-11-11T01:52:18Z","date_published":"2026-11-11T01:52:18Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/","summary":"Mongoose versions prior to the patches failed to apply the sanitizeFilter utility to countDocuments() queries, allowing potential NoSQL injection when user input is passed directly to the filter argument.","title":"Mongoose: countDocuments() sanitizeFilter bypass (CVE-2026-125120)","url":"https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mongoose:mongoose:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}