{"id":"ghsa-ghsa-jqw5-w6h3-44g6","seq":2413,"kind":"advisory","title":"ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document","url":"https://github.com/advisories/GHSA-jqw5-w6h3-44g6","permalink":"https://vulnpulse.app/items/ghsa-ghsa-jqw5-w6h3-44g6","summary":"影響: npm:@apostrophecms/import-export < 3.7.0 → 3.7.0\nSummary @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property (for example slug:key) whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey()/insertOrUpdateDocWithKey() (lib/methods/import.js) use that value directly as a MongoDB query value with no laundering: js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: 'draft' }), { aposMode: 'draft', [updateField]: doc[updateKey] }).t…","severity":"medium","techs":["nodejs","mongodb"],"cves":["CVE-2026-113662"],"tags":["GHSA-jqw5-w6h3-44g6","@apostrophecms/import-export"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:19:19.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}