## ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs, mongodb
- CVE: CVE-2026-113662
- 公開日時: 2026-10-20T18:19:19.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-jqw5-w6h3-44g6)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-jqw5-w6h3-44g6

影響: npm:@apostrophecms/import-export < 3.7.0 → 3.7.0
Summary @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property (for example slug:key) whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey()/insertOrUpdateDocWithKey() (lib/methods/import.js) use that value directly as a MongoDB query value with no laundering: js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: 'draft' }), { aposMode: 'draft', [updateField]: doc[updateKey] }).t…