Mongoose implements the sanitizeFilter option to wrap query operators in $eq and neutralize them before the query is sent to MongoDB. Prior to the security fix, the $nor logical operator was omitted from the list of operators that received recursive sanitization. Because $nor accepts an array payload, the presence of the operator bypasses the hasDollarKeys check that would normally remove other injection vectors such as $ne, $gt, or $regex. The result is a NoSQL injection vulnerability that allows an attacker to inject malicious query operators and craft arbitrary queries that can read, modify, or delete application data without authorization.

The issue affects applications using Automattic’s Mongoose library versions earlier than 6.13.9, 7.8.9, 8.22.1, or 9.1.6. Any deployment that incorporates one of these vulnerable releases and enables sanitizeFilter can be exposed to the described injection attack.

The vulnerability is rated CVSS 7.5, indicating a high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through any user‑controlled query building that passes through Mongoose’s sanitizeFilter. If an application accepts untrusted input for query filters, an attacker could embed a $nor clause containing injected operators, achieving unauthorized data retrieval or manipulation. The lack of an EPSS score does not imply low risk; the vulnerability remains exploitable whenever the conditions are met.