GitHub Advisoryadvisory · npm

GHSA-hxwc-5vw9-2w4w NoSQL Injection in loopback-connector-mongodb

HIGH Published 2020-09-02 Modified 2021-09-27 Official page ↗
Ecosystem
npm
Packages
loopback-connector-mongodb
Severity
High
Weaknesses
CWE-89
Reviewed
2020-08-31

Affected packages

• npm loopback-connector-mongodb: < 3.6.0 → fixed in 3.6.0

Description

Versions of `loopback-connector-mongodb` prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak. Recommendation Upgrade to version 3.6.0 or later.

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References