CVE-2020-7610
Deserialization of Untrusted Data in bson
CVE-2020-7610 is a critical vulnerability (CVSS 9.8) in Mongodb Bson, published March 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.27%, the 83rd percentile. Fixed in bson 1.1.4.
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
- Record
CVE-2020-7610- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
- Record
CVE-2020-7610- Updated
- 2026-11-02
EUVDEUVD-2021-1199 No score
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
- Record
EUVD-2021-1199- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v8w9-2789-6hhr
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
- Record
GHSA-v8w9-2789-6hhr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
- Record
CVE-2020-7610- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-7610
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
- Record
DEBIAN-CVE-2020-7610- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-v8w9-2789-6hhr
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
- Record
GHSA-v8w9-2789-6hhr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7610
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
- Record
UBUNTU-CVE-2020-7610- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1774225203 No score
TuxCare security update for bson (2 CVEs)
TuxCare rebuilt bson to address 2 CVEs. Fixed in 1.0.9-tuxcare.1.
- Record
CLSA-2026-1774225203- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2020-7610 No score
CVE-2020-7610 in @rootio/bson - Patched by Root
Root has patched CVE-2020-7610 in the @rootio/bson package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2020-7610- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bsonnpm |
before 1.1.4 | 1.1.4 |
bsonTuxCare:npm |
1.0.9-tuxcare.0 up to 1.0.9-tuxcare.1, plus listed versions 1.0.9 |
1.0.9-tuxcare.1 |
node-mongodbDebian:12 |
before 3.5.6+~cs11.12.19-1 | 3.5.6+~cs11.12.19-1 |
@rootio/bsonRoot:npm |
before 1.0.9-root.io.1 | 1.0.9-root.io.1 |
bsonRoot:npm |
before 1.0.9-aikido.1 | 1.0.9-aikido.1 |
node-mongodbUbuntu:20.04:LTS |
All versions, plus listed versions 3.3.1+~3.2.7-13.3.2+~3.2.7-13.3.3+~3.2.7-13.3.5+~3.2.7-13.4.0+~3.2.7-1 Show 5 moreShow less3.4.1+~3.2.7-13.5.0+~3.2.7-13.5.2+~3.2.7-13.5.3+~3.2.7-13.5.5+~3.2.7-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
snyk.io/vuln/SNYK-JS-BSON-561052
nvd.nist.gov/vuln/detail/CVE-2020-7610
github.com/mongodb/js-bson/commit/3809c1313a7b2a8001065f0271199df9fa3d16a8
security-tracker.debian.org/tracker/CVE-2020-7610
ubuntu.com/security/CVE-2020-7610
cve.org/CVERecord?id=CVE-2020-7610