Vulnerability details
CVE-2026-125120
Automattic mongoose
Mongoose: sanitizeFilter not applied on countDocuments
CVSS 3.1
9.8Critical
Official description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Automattic | mongoose | < 6.13.11 | CVEProject cvelistV5 (CNA) |
| Automattic | mongoose | >= 7.0.0, < 7.8.12 | CVEProject cvelistV5 (CNA) |
| Automattic | mongoose | >= 8.0.0, < 8.24.3 | CVEProject cvelistV5 (CNA) |
| Automattic | mongoose | >= 9.0.0, < 9.9.2 | CVEProject cvelistV5 (CNA) |
References and advisories
9- https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h x_refsource_CONFIRM
- https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a x_refsource_MISC
- https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557 x_refsource_MISC
- https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d x_refsource_MISC
- https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710 x_refsource_MISC
- https://github.com/Automattic/mongoose/releases/tag/6.13.11 x_refsource_MISC
- https://github.com/Automattic/mongoose/releases/tag/7.8.12 x_refsource_MISC
- https://github.com/Automattic/mongoose/releases/tag/8.24.3 x_refsource_MISC
- https://github.com/Automattic/mongoose/releases/tag/9.9.2 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-10
- Last updated
- 2026-11-10
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 27 · Low
Exploit prediction (EPSS)
0.56%
Probability of exploitation in 30 days
47.4%
Percentile (among all CVEs)
Weaknesses (CWE)
- CWE-943Improper Neutralization of Special Elements in Data Query Logic