CriticalGHSA-8687-vv9j-hgphCVE-2019-17426

Improper Input Validation in Automattic Mongoose

Published 22 Oct 2019 · Updated 29 Nov 2023

Affected packages

mongoosenpm

Affected: >=5.0.0 <5.7.5
Fixed in: 5.7.5

Update to the fixed version for your release line, for example:npm install mongoose@5.7.5

mongoosenpm

Affected: <4.13.21
Fixed in: 4.13.21

Update to the fixed version for your release line, for example:npm install mongoose@4.13.21

Details

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

Is GHSA-8687-vv9j-hgph in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected mongoose, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.