loopbackio/loopback-connector-mongodb · Security
NoSQL Injection in loopback-connector-mongodb
- GHSA ID
- GHSA-hxwc-5vw9-2w4w
- Severity
- high
- Published
- Updated
Description
Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.
Recommendation
Upgrade to version 3.6.0 or later.
CWEs
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')