Severity: Critical
CVSS Score: 9.1
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.