GHSA-97mg-3cr6-3x4c
Remote Code Execution in mongodb-query-parser
Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file:
'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'
Recommendation
Upgrade to version 2.0.0 or later.
What each source reports
GitHub AdvisoriesNo score
Remote Code Execution in mongodb-query-parser
Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file:
'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'
Recommendation
Upgrade to version 2.0.0 or later.
- Record
GHSA-97mg-3cr6-3x4c- Updated
- 2026-11-02
OSVNo score
Remote Code Execution in mongodb-query-parser
Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file:
'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'
Recommendation
Upgrade to version 2.0.0 or later.
- Record
GHSA-97mg-3cr6-3x4c- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mongodb-query-parsernpm | before 2.0.0 | 2.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-97mg-3cr6-3x4c is a vulnerability with no CVSS score yet in mongodb-query-parser, published September 4, 2020. No source lists public exploit code. Fixed in mongodb-query-parser 2.0.0.