{"id":"GHSA-gg4r-jv3p-qx3c","summary":"Mongoose: Connection-level sanitizeFilter not applied","details":"### Summary\n\nsanitizeFilter exists to stop query selector injection: it wraps operator objects such as `{ $ne: null }` in filter values in `$eq`, so they are matched literally. Set on a connection with `mongoose.connect()` or `createConnection(uri, { sanitizeFilter: true })`, the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to selector injection, and a password value of `{ $ne: null }` returns the account record without the password.\n\n### Details\n\n`NativeConnection#createClient()` at `lib/drivers/node-mongodb-native/connection.js:270-272` moves `options.sanitizeFilter` into `Connection.config` and deletes the original option. `Query#_castConditions()` at `lib/query.js:2413-2423` checks `Connection.options`, the global `options`, and the per-query options, but never `Connection.config`. The defense therefore does not run even though `Connection#get('sanitizeFilter')` returns true. This storage was introduced in Mongoose 6.0.0 and the same mismatch is present in 9.11.2.\n\n### Proof of concept\n\n```javascript\nimport mongoose from 'mongoose'\n\nconst conn = await mongoose.createConnection('\u003cMONGODB_URI\u003e', { sanitizeFilter: true }).asPromise()\nconst User = conn.model('User', new mongoose.Schema({\n  username: String,\n  password: String,\n  marker: String\n}))\n\nawait User.create({\n  username: 'victim',\n  password: 'correct-password',\n  marker: 'PROTECTED_RECORD'\n})\n\nconst filter = { username: 'victim', password: { $ne: null } }\nconsole.log(conn.get('sanitizeFilter'))\nconsole.log((await User.findOne(filter).lean()).marker)\n```\n\nA control query with a literal wrong password returned no document in the same run, confirming the filter is otherwise enforced.\n\n### Impact\n\nConnection-level `sanitizeFilter` option is not respected. Any user that relies on connection-level config and `sanitizeFilter` to defend against query selector injection is affected. Users that set `sanitizeFilter` globally using `mongoose.set('sanitizeFilter')` or on specific queries using `Model.find().sanitizeFilter()` are not affected.","aliases":["CVE-2026-125119"],"modified":"2026-11-10T20:00:05.034751092Z","published":"2026-11-10T19:56:12Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-11-10T19:56:12Z","nvd_published_at":"2026-11-09T23:17:22Z","cwe_ids":["CWE-943"]},"references":[{"type":"WEB","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125119"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/4bb659478be2f30655a7bdd78bc251bdf111cd29"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/4f4f9a79f860786a54133bee2c9af967ec691491"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/83eda6af1489e9ef60bb8eee8cf9ee005771b9d5"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/b8970c25998c23fbccd17f76c0398b902ff4911d"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"}],"affected":[{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.13.12"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gg4r-jv3p-qx3c/GHSA-gg4r-jv3p-qx3c.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.8.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gg4r-jv3p-qx3c/GHSA-gg4r-jv3p-qx3c.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.24.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gg4r-jv3p-qx3c/GHSA-gg4r-jv3p-qx3c.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.11.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gg4r-jv3p-qx3c/GHSA-gg4r-jv3p-qx3c.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}