ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
影響: npm:@apostrophecms/import-export < 3.7.0 → 3.7.0
@apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property (for example slug:key) whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey()/insertOrUpdateDocWithKey() (lib/methods/import.js) use that value directly as a MongoDB query value with no laundering: js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: 'draft' }), { aposMode: 'draft', [updateField]: doc[updateKey] }).t…
Read on GitHub Advisory Database
| CVE | CVE-2026-113662 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/22/2026, 01:17 AM |
| Data | Markdown JSON |
On 10/21/2026, 03:19 AM, GitHub Advisory Database published "ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js, MongoDB. CVE: CVE-2026-113662.