ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

影響: npm:@apostrophecms/import-export < 3.7.0 → 3.7.0

@apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property (for example slug:key) whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey()/insertOrUpdateDocWithKey() (lib/methods/import.js) use that value directly as a MongoDB query value with no laundering: js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: 'draft' }), { aposMode: 'draft', [updateField]: doc[updateKey] }).t…

GitHub Advisory Databaseで読む

2026/10/21 03:19、GitHub Advisory Databaseが「ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js、MongoDB。CVE: CVE-2026-113662。