Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
automattic/mongoose
master @ 87ade9b
108
Fixes
50
CVEs
CRITICAL
Peak severity
60.0%
Coverage
Highlights
Denial of Service: 46 prior fixes. Scrutinize any change in this area.
lib/document.js: most-fixed (19 issues). Treat as high-risk during review.
43 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Attackers can exploit the $where operator nested inside populate match parameters to run arbitrary JavaScript code in the MongoDB process context. This risk is actively documented under CVE-2024-53900 and CVE-2025-23061.
NoSQL Injection: Incomplete sanitization of complex logical operators (such as $nor, $and, and $or) allows attackers to supply malicious query parameters that bypass sanitizeFilter checks to leak data or alter updates globally.
Prototype Pollution: Schema compilation and document initialization pathways historically failed to protect internal dictionaries against special keys like __proto__ or constructor, allowing malicious document structures to modify Object.prototype globally.