How to: CVE-2025-23061 (2025-01-15)
```
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
```
- [dajneem23/CVE-2025-23061](https://github.com/dajneem23/CVE-2025-23061)