The CVE-2025-23061 advisory is incomplete and `npm audit` is wrong #15186

jsilvawbc · 2025-01-17T15:32:03Z

Prerequisites

I have written a descriptive issue title
I have searched existing issues to ensure the bug has not already been reported

Mongoose version

7.8.4

Node.js version

18

MongoDB server version

6

Typescript version (if applicable)

5.4

Description

The commit lists as fixed versions: 8.9.5, 7.8.4, and 6.13.6

The CVE advisory however: Affected versions: < 8.9.5 / Patched versions: 8.9.5

Steps to Reproduce

On a project with versions 7.8.4, or 6.13.6 do an: npm audit

Expected Behavior

No vulnerability reported.

hunkydoryrepair · 2025-01-17T18:21:41Z

I think you (or somebody) would have to report that to CVE.org.

vkarpov15 · 2025-01-17T19:39:30Z

I updated the vulnerability in Tidelift to indicate that 7.8.4 and 6.13.6 have a fix. GitHub already has the correct patched versions, so that should propagate to npm audit because npm audit supposedly pulls from GitHub advisories

eldhoseelias · 2025-01-17T21:33:32Z

skhilliard · 2025-01-17T22:03:27Z

Just to show that is still shows up for 6.13.6 also

yuval-shimoni-hunters · 2025-01-19T09:46:26Z

We have the same issue.
We upgraded to ^6.13.6 and still get the critical warning.

It indeed remove one reference, but still show one error

Is anyone manage to solve it?

ofekifergan · 2025-01-19T10:46:43Z

We are having the same issue and it's blocking us please fix this asap

ofekifergan · 2025-01-19T16:00:33Z

any update?

eranziz · 2025-01-20T08:07:41Z

it's happening for me also. very urgent. any updates for a fix ?????

dudilugasi · 2025-01-20T08:09:46Z

This issue is happening to me as well. It's important to address this because the CVE advisory and npm audit results are conflicting, causing unnecessary concerns for projects using the supposedly patched versions (7.8.4 and 6.13.6). Clarifying the advisory and ensuring npm audit reflects the correct information is crucial for maintaining trust and reliability in vulnerability reporting.

royscymulate · 2025-01-20T08:11:04Z

I'm encountering the same problem. It's urgent—any updates on resolving this

jsilvawbc · 2025-01-20T08:30:40Z

Perhaps the only way out of this is for the maintainer @vkarpov15 to issue a new version bump for v6 and v7 to force npm to refresh the audit reports, as the original CVE was updated after the fact.

jsilvawbc · 2025-01-20T11:17:01Z

I'm having trouble getting help from npm directly. I initially reached out to them via email as advised, but they directed me to their support website, which requires logging in to submit a request.

I was only able to access the malware report form without logging in, which isn't relevant to my issue. I did attempt to contact them using the only form available, but I'd appreciate it if we could discuss a solution directly here.

I've provided detailed information, including a link to this GitHub issue, and I'd like to avoid having to recreate my request on a different platform if possible.

[npm Support] Confirmation - Request Received (#3191583)

vkarpov15 · 2025-01-20T14:22:07Z

Ok, I'll ship a version bump for v6 and v7 now. I'm sorry for the trouble - in our defense we didn't file the CVE report, if I understand correctly Tidelift filed the CVE for us, we will have to make it more clear next time that we will ship fixes for 6.x and 7.x as well.

eldhoseelias · 2025-01-20T15:41:53Z

Issue still exists with 7.8.4 and 7.8.5

jsilvawbc · 2025-01-20T15:51:01Z

Yes, sadly it did not work the way I expected. I am a simple user. Someone with actual reputation should escalate the issue at npm.

vkarpov15 · 2025-01-20T15:55:44Z

Yeah I pushed a version bump, but I am still getting an npm audit warning:

$ npm audit
# npm audit report

mongoose  <8.9.5
Severity: critical
Mongoose search injection vulnerability - https://github.com/advisories/GHSA-vg7j-7cwx-8wgw
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/mongoose

1 critical severity vulnerability

To address all issues (including breaking changes), run:
  npm audit fix --force
$ head node_modules/mongoose/package.json 
{
  "name": "mongoose",
  "description": "Mongoose MongoDB ODM",
  "version": "7.8.6",
  "author": "Guillermo Rauch <[email protected]>",
  "keywords": [
    "mongodb",
    "document",
    "model",
    "schema",

Will reach out to npm support.

vkarpov15 · 2025-01-20T15:58:31Z

I have reached out to npm support, will post here when I have update.

royscymulate · 2025-01-21T09:30:50Z

Any updates?

jsilvawbc · 2025-01-21T12:24:27Z

I think it's worth noting that the recent layoffs at Microsoft, which owns npm, may be contributing to the delays and inefficiencies in addressing this issue. Microsoft laid off 5% of its global workforce in January 2023, and reports indicate that the company is continuing to cut jobs, including another 1% of the workforce, with roles in the security division being affected.

These layoffs may have impacted the npm team and their ability to respond to issues like this one. While the maintainer has already reached out to npm support, we’re not receiving the attention needed to resolve this problem.

Does anyone have connections with people who still work at Microsoft, particularly in the npm team, who could help escalate this issue to a higher level? It would be beneficial to gain more visibility and priority on this matter, as it affects multiple projects and users.

Let's keep the conversation constructive and focused on finding a solution. If anyone has suggestions or ideas on how to move this forward, please share them.

Thank you.

Jehadsama · 2025-01-24T01:22:31Z

Any further updates?

sudhackar · 2025-01-24T05:26:09Z

Copying from cli issue:
This is because even though the advisory seems to be fixed on github - the npm registry API is returning it vulnerable. There's probably caching at some layer as the updates to an advisory might take time.

$ curl -s  https://registry.npmjs.org/-/npm/v1/security/advisories/bulk --json '{"mongoose": ["7.8.6"]}' | jq .
{
  "mongoose": [
    {
      "id": 1101526,
      "url": "https://github.com/advisories/GHSA-vg7j-7cwx-8wgw",
      "title": "Mongoose search injection vulnerability",
      "severity": "critical",
      "vulnerable_versions": "<8.9.5",
      "cwe": [
        "CWE-94"
      ],
      "cvss": {
        "score": 9.1,
        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
      }
    }
  ]
}

$ curl -s  https://registry.npmjs.org/-/npm/v1/security/advisories/bulk --json '{"mongoose": ["8.9.5"]}' | jq .
{}

github/advisory-database@acba20c shows the new updated versions were fixed last week, this is a long time.
https://api.github.com/advisories/GHSA-vg7j-7cwx-8wgw also returns the correct values

$ curl -s https://api.github.com/advisories/GHSA-vg7j-7cwx-8wgw | jq -r ".vulnerabilities[].first_patched_version"
8.9.5
7.8.4
6.13.6

Additionally:

So the problem only boils down to the npm registry API at registry.npmjs.org which is not open source and the only way to get it fixed is just the npm org - as vkarpov15 has reached out.

A solution right now could be to allowlist this advisory

vkarpov15 · 2025-01-24T20:38:42Z

I haven't heard back from npm, all I got was the following seemingly automated message:

skrtheboss · 2025-01-27T10:36:18Z

It seems to have been fixed now 🎊 🚀

sudhackar · 2025-01-27T11:13:54Z

The API seems to be returning correct values now

"vulnerable_versions": "<6.13.6",
"vulnerable_versions": ">=7.0.0-rc0 <7.8.4",
"vulnerable_versions": ">=8.0.0-rc0 <8.9.5",

for

$ curl -s  https://registry.npmjs.org/-/npm/v1/security/advisories/bulk --json '{"mongoose": ["8.9.1"]}' | jq .
{
  "mongoose": [
    {
      "id": 1101840,
      "url": "https://github.com/advisories/GHSA-vg7j-7cwx-8wgw",
      "title": "Mongoose search injection vulnerability",
      "severity": "critical",
      "vulnerable_versions": ">=8.0.0-rc0 <8.9.5",
      "cwe": [
        "CWE-94"
      ],
      "cvss": {
        "score": 9.1,
        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
      }
    }
  ]
}

jsilvawbc · 2025-01-27T11:47:37Z

Good! I confirmed and it's okay now. Thank you. Closing.

hbazan-pp · 2025-01-27T15:33:35Z

What happened to tag 7.8.6? the latest for @7 is now 7.8.4, when this issue started there were a 7.8.6 version.
Also, does 7.8.4 have this CVE fixed?

jsilvawbc · 2025-01-27T18:33:06Z

What happened to tag 7.8.6? the latest for @7 is now 7.8.4, when this issue started there were a 7.8.6 version. Also, does 7.8.4 have this CVE fixed?

It's fine. 73e81ab...b29ee14 🙏

hbazan-pp · 2025-01-27T18:38:37Z

if I check tags list on this repo there's no 7.8.6

jsilvawbc · 2025-01-29T07:29:19Z

if I check tags list on this repo there's no 7.8.6

@vkarpov15 Can you please take a look, and make/push the tags? Thank you.

jsilvawbc mentioned this issue Jan 21, 2025

[BUG] npm audit is wrong regarding CVE-2025-23061 advisory npm/cli#8049

Closed

2 tasks

jsilvawbc closed this as completed Jan 27, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

The CVE-2025-23061 advisory is incomplete and `npm audit` is wrong #15186

The CVE-2025-23061 advisory is incomplete and `npm audit` is wrong #15186

jsilvawbc commented Jan 17, 2025

hunkydoryrepair commented Jan 17, 2025

vkarpov15 commented Jan 17, 2025

eldhoseelias commented Jan 17, 2025

skhilliard commented Jan 17, 2025

yuval-shimoni-hunters commented Jan 19, 2025 •

edited

Loading

ofekifergan commented Jan 19, 2025

ofekifergan commented Jan 19, 2025

eranziz commented Jan 20, 2025

dudilugasi commented Jan 20, 2025

royscymulate commented Jan 20, 2025

jsilvawbc commented Jan 20, 2025

jsilvawbc commented Jan 20, 2025 •

edited

Loading

vkarpov15 commented Jan 20, 2025

eldhoseelias commented Jan 20, 2025

jsilvawbc commented Jan 20, 2025

vkarpov15 commented Jan 20, 2025

vkarpov15 commented Jan 20, 2025

royscymulate commented Jan 21, 2025

jsilvawbc commented Jan 21, 2025

Jehadsama commented Jan 24, 2025

sudhackar commented Jan 24, 2025 •

edited

Loading

vkarpov15 commented Jan 24, 2025

skrtheboss commented Jan 27, 2025

sudhackar commented Jan 27, 2025

jsilvawbc commented Jan 27, 2025

hbazan-pp commented Jan 27, 2025

jsilvawbc commented Jan 27, 2025

hbazan-pp commented Jan 27, 2025

jsilvawbc commented Jan 29, 2025

The CVE-2025-23061 advisory is incomplete and npm audit is wrong #15186

The CVE-2025-23061 advisory is incomplete and npm audit is wrong #15186

Comments

jsilvawbc commented Jan 17, 2025

Prerequisites

Mongoose version

Node.js version

MongoDB server version

Typescript version (if applicable)

Description

Steps to Reproduce

Expected Behavior

hunkydoryrepair commented Jan 17, 2025

vkarpov15 commented Jan 17, 2025

eldhoseelias commented Jan 17, 2025

skhilliard commented Jan 17, 2025

yuval-shimoni-hunters commented Jan 19, 2025 • edited Loading

ofekifergan commented Jan 19, 2025

ofekifergan commented Jan 19, 2025

eranziz commented Jan 20, 2025

dudilugasi commented Jan 20, 2025

royscymulate commented Jan 20, 2025

jsilvawbc commented Jan 20, 2025

jsilvawbc commented Jan 20, 2025 • edited Loading

vkarpov15 commented Jan 20, 2025

eldhoseelias commented Jan 20, 2025

jsilvawbc commented Jan 20, 2025

vkarpov15 commented Jan 20, 2025

vkarpov15 commented Jan 20, 2025

royscymulate commented Jan 21, 2025

jsilvawbc commented Jan 21, 2025

Jehadsama commented Jan 24, 2025

sudhackar commented Jan 24, 2025 • edited Loading

vkarpov15 commented Jan 24, 2025

skrtheboss commented Jan 27, 2025

sudhackar commented Jan 27, 2025

jsilvawbc commented Jan 27, 2025

hbazan-pp commented Jan 27, 2025

jsilvawbc commented Jan 27, 2025

hbazan-pp commented Jan 27, 2025

jsilvawbc commented Jan 29, 2025

The CVE-2025-23061 advisory is incomplete and `npm audit` is wrong #15186

The CVE-2025-23061 advisory is incomplete and `npm audit` is wrong #15186

yuval-shimoni-hunters commented Jan 19, 2025 •

edited

Loading

jsilvawbc commented Jan 20, 2025 •

edited

Loading

sudhackar commented Jan 24, 2025 •

edited

Loading