CVE-2026-113662: ApostropheCMS Import-Export NoSQL Injection Vulnerability
Summary
CVE-2026-113662: @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property (for example slug:key) whose value is used to find an existing document to update instead of inserting a new one. Affects @apostrophecms/import-export versions < 3.7.0. Fixed in 3.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is a content management system designed for building websites and applications with a focus on ease of use and flexibility. The '@apostrophecms/import-export' package facilitates the import and export of content, allowing users to manage their data efficiently. However, it has a vulnerability that allows for NoSQL injection through improperly handled update-key values, which can lead to unauthorized document modifications.
Vulnerability Detail
The vulnerability arises from the '@apostrophecms/import-export' package's update-by-key feature, which allows an imported document to specify a '<field>:key' property. This property is used to locate an existing document for updating. The method 'getUpdateKey()' and 'insertOrUpdateDocWithKey()' directly use this value as a MongoDB query without proper validation. This oversight allows attackers to craft an import with a NoSQL operator, such as '{ "$ne": null }', which can match and overwrite unintended documents. The impact is significant as it allows authenticated users with import access to modify any document they have edit rights to, potentially leading to data loss or corruption.
How To Fix
Latest published version: 3.7.1 as of 22 Oct 2026
npm install @apostrophecms/import-export@3.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.0
This is the first release that contains the fix.
npm install @apostrophecms/import-export@3.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any imported documents do not contain fields that could be interpreted as MongoDB operators. Additionally, consider restricting import access to trusted users only until the package is updated.
Conclusion
The '@apostrophecms/import-export' package has a critical NoSQL injection vulnerability that can lead to unauthorized document modifications. It is essential to update to the patched version 3.7.0 to mitigate this risk. Users should also consider using Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for @apostrophecms/import-export →
FAQ
The vulnerability allows for NoSQL injection through the update-key feature, enabling unauthorized modifications to documents.
Any user with authenticated access to import content using the '@apostrophecms/import-export' package is potentially affected.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of severity.
If an immediate update is not possible, restrict import access to trusted users and avoid using fields that could be interpreted as MongoDB operators in your imports.
References
Related vulnerabilities
Recent vulnerabilities recorded for @apostrophecms/import-export.
