CVE-2025-23061: Mongoose search injection vulnerability

The vulnerability stems from improper validation of the $where operator in populate() match clauses. The original code in getModelsMapForPopulate.js checked for $where at the top level or in arrays but failed to recursively inspect nested objects (e.g., $or, $and). The patch introduced a recursive throwOn$where function to address this. The affected functions (getModelsMapForPopulate and _virtualPopulate) processed the match parameter without this recursive check in vulnerable versions, making them entry points for injection. The commit diff and CVE description explicitly reference this population match handling as the flawed component.