GitHub Advisoryadvisory · npm

GHSA-v8w9-2789-6hhr Deserialization of Untrusted Data in bson

CRITICAL Published 2021-05-07 Modified 2023-03-30 Official page ↗
Aliases
CVE-2020-7610
Ecosystem
npm
Packages
bson
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-05-06

Affected packages

• npm bson: < 1.1.4 → fixed in 1.1.4

Description

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Related

Alias · CVE (1)

  • CVE-2020-7610 All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References