Command Injection in marsdb

Description

All versions of marsdb are vulnerable to Command Injection. In the DocumentMatcher class, selectors on $where clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-5mrr-rgp6-x4gr
• www.npmjs.com
• CWE-77
• OWASP 2021-A3

Related Issues

• Command Injection in ascii-art - Vulnerability
• chromedriver Command Injection vulnerability - CVE-2023-26156
• automagik-genie has a command injection vulnerability - CVE-2026-30635
• Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE - Vulnerability

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

marsdb