JEDI-SEC | Security Research & Digital Defense

GHSA-gg4r-jv3p-qx3c: Mongoose: Connection-level sanitizeFilter not applied

Written by

jedisec_u136k7

in

  • Severity: HIGH
  • CVE: CVE-2026-125119
  • Ecosystems: npm, npm, npm, npm
  • Packages: mongoose, mongoose, mongoose, mongoose

### Summary

sanitizeFilter exists to stop query selector injection: it wraps operator objects such as `{ $ne: null }` in filter values in `$eq`, so they are matched literally. Set on a connection with `mongoose.connect()` or `createConnection(uri, { sanitizeFilter: true })`, the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to selector injection, and a password value of `{ $ne: null }` returns the account record without the password.

### Details

`NativeConnection#createClient()` at `lib/drivers/node-mongodb-native/connection.js:270-272` moves `options.sanitizeFilter` into `Connection.config` and deletes the original option. `Query#_castConditions()` at `lib/query.js:2413-2423` checks `Connection.options`, the global `options`, and the per-query options, but never `Connection.config`. The defense therefore does not run even though `Connection#get(‘sanitizeFilter’)` returns true. This storage was introduced in Mongoose 6.0.0 and the same mismatch is present in 9.11.2.

### Proof of concept

“`javascript
import mongoose from ‘mongoose’

const conn = await mongoose.createConnection(”, { sanitizeFilter: true }).asPromise()
const User = conn.model(‘User’, new mongoose.Schema({
username: String,
password: String,
marker: String
}))

await User.create({
username: ‘victim’,
password: ‘correct-password’,
marker: ‘PROTECTED_REC…

Source: GitHub Security Advisories · 2026-11-10

More posts