GHSA-hxwc-5vw9-2w4w
NoSQL Injection in loopback-connector-mongodb
GHSA-hxwc-5vw9-2w4w is a vulnerability with no CVSS score yet in loopback-connector-mongodb, published September 2, 2020. No source lists public exploit code. Fixed in loopback-connector-mongodb 3.6.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.6.0loopback-connector-mongodb +1 more
Description
Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.
Recommendation
Upgrade to version 3.6.0 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
loopback-connector-mongodbnpm | through 3.5.0 | 3.6.0 |
loopback-connector-mongodbnpm | before 3.6.0 | 3.6.0 |
What each source reports
GitHub AdvisoriesNo score
NoSQL Injection in loopback-connector-mongodb
Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.
Recommendation
Upgrade to version 3.6.0 or later.
- Record
GHSA-hxwc-5vw9-2w4w- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVNo score
NoSQL Injection in loopback-connector-mongodb
Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.
Recommendation
Upgrade to version 3.6.0 or later.
- Record
GHSA-hxwc-5vw9-2w4w- Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.