Deserialization of Untrusted Data in bson

Description

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object’s _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Recommendation

Update the bson package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.4
• Patched version(s): 1.1.4

References

• GHSA-v8w9-2789-6hhr
• snyk.io
• CVE-2020-7610
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• seajs Cross-site Scripting vulnerability - CVE-2024-51091
• XSS vulnerability that affects bootstrap - CVE-2018-20676
• Server-Side Template Injection in formio - CVE-2020-28246
• Path traversal in webpack-dev-middleware - CVE-2024-29180

Tags:

npm

bson