Automattic Mongoose up to 6.13.10/7.8.11/8.24.2/9.9.1 Query Selector countDocuments code injection

Summaryinfo

A vulnerability categorized as critical has been discovered in Automattic Mongoose up to 6.13.10/7.8.11/8.24.2/9.9.1. Affected by this issue is the function countDocuments of the component Query Selector. The manipulation results in code injection. This vulnerability is cataloged as CVE-2026-125120. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Automattic Mongoose up to 6.13.10/7.8.11/8.24.2/9.9.1. Affected is the function countDocuments of the component Query Selector. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-125120 since 11/09/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

Upgrading to version 6.13.11, 7.8.12, 8.24.3 or 9.9.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Automattic

Name

• Mongoose

Version

• 6.13.0
• 6.13.1
• 6.13.2
• 6.13.3
• 6.13.4
• 6.13.5
• 6.13.6
• 6.13.7
• 6.13.8
• 6.13.9
• 6.13.10
• 7.8.0
• 7.8.1
• 7.8.2
• 7.8.3
• 7.8.4
• 7.8.5
• 7.8.6
• 7.8.7
• 7.8.8
• 7.8.9
• 7.8.10
• 7.8.11
• 8.24.0
• 8.24.1
• 8.24.2
• 9.9.0
• 9.9.1

Website

• Product: https://github.com/Automattic/mongoose/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion