{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mongoose--6.13.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongoose:mongoose:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-125120"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mongoose (\u003c 6.13.11)","mongoose (\u003e= 7.0.0, \u003c 7.8.12)","mongoose (\u003e= 8.0.0, \u003c 8.24.3)","mongoose (\u003e= 9.0.0, \u003c 9.9.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Mongoose"],"content_html":"\u003cp\u003eMongoose failed to apply the \u003ccode\u003esanitizeFilter\u003c/code\u003e security utility to \u003ccode\u003ecountDocuments()\u003c/code\u003e queries, which is designed to protect against query selector injection attacks. If an application passes unsanitized user-supplied input directly to the \u003ccode\u003ecountDocuments()\u003c/code\u003e filter argument, an attacker may be able to inject malicious query selectors. This vulnerability is identified as CVE-2026-125120.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow an attacker to alter the query logic of database operations, potentially resulting in unauthorized data exposure or information disclosure depending on how the application handles the query results.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade Mongoose to the following versions or later to ensure \u003ccode\u003esanitizeFilter\u003c/code\u003e is applied correctly to \u003ccode\u003ecountDocuments()\u003c/code\u003e queries:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to version ^9.9.2\u003c/li\u003e\n\u003cli\u003eUpgrade to version ^8.24.3\u003c/li\u003e\n\u003cli\u003eUpgrade to version ^7.8.12\u003c/li\u003e\n\u003cli\u003eUpgrade to version ^6.13.11\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eIf immediate upgrading is not possible, implement the provided middleware to enforce filtering on \u003ccode\u003ecountDocuments\u003c/code\u003e calls as a temporary mitigation.\u003c/p\u003e\n","date_modified":"2026-11-11T01:52:18Z","date_published":"2026-11-11T01:52:18Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/","summary":"Mongoose versions prior to the patches failed to apply the sanitizeFilter utility to countDocuments() queries, allowing potential NoSQL injection when user input is passed directly to the filter argument.","title":"Mongoose: countDocuments() sanitizeFilter bypass (CVE-2026-125120)","url":"https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Mongoose (\u003c 6.13.11)","version":"https://jsonfeed.org/version/1.1"}