ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

影響: npm:@apostrophecms/import-export < 3.7.0 → 3.7.0

@apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property (for example slug:key) whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey()/insertOrUpdateDocWithKey() (lib/methods/import.js) use that value directly as a MongoDB query value with no laundering: js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: 'draft' }), { aposMode: 'draft', [updateField]: doc[updateKey] }).t…

在 GitHub Advisory Database 阅读

2026/10/21 03:19，GitHub Advisory Database 发布了“ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js、MongoDB。CVE：CVE-2026-113662。