Mongoose populate() $where injection (CVE-2025-23061, CVE-2024-53900) enables RCE on Node.js servers; F5 sees mass exploitation as unlikely
F5 Labs analyzes CVE-2025-23061 and its predecessor CVE-2024-53900, a CVSS 9.0 flaw in the Mongoose MongoDB client library that allows remote code execution on Node.js API servers. The bug abuses the populate method, which accepts a $where clause containing arbitrary JavaScript. The initial fix for CVE-2024-53900 blocked only top-level $w…