Description
If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB.
Schemas that do not use @flexSearchFulltext are not affected.
Recommendation
Update the cruddl package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.1.0, < 2.7.0 >= 3.0.0, < 3.0.2** Patched version(s): **2.7.0 3.0.2**
References
Could your website be exposed too?
SmartScanner can check your website for cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Matrix-appservice-irc vulnerable to sql injection via roomIds argument - CVE-2022-3971
- nadesiko3 vulnerable to OS Command Injection - CVE-2022-42496
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
- Editor.js vulnerable to Code Injection - CVE-2022-23474
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023