VulertSecurity VulertSecurity

NoSQL Injection in loopback-connector-mongodb

loopback-connector-mongodb Updated 02 Oct 2025

Summary

02/09/2020
HIGH
Yes i
High
Not published

GHSA-hxwc-5vw9-2w4w: NoSQL Injection in loopback-connector-mongodb. Affects loopback-connector-mongodb versions < 3.6.0. Fixed in 3.6.0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats
SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml
Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile
Javascript package-lock.json · yarn.lock · pnpm-lock.yaml
PHP composer.lock
Python poetry.lock · requirements.txt · Pipfile.lock
Go go.mod
Rust Cargo.lock
Ruby Gemfile.lock
Dart pubspec.lock
C/C++ conan.lock
Elixir mix.lock
Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

A free account is created for continuous monitoring. By scanning, you agree to our Terms & Conditions.

Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

Background

loopback-connector-mongodb is an npm package that serves as a connector for MongoDB in the LoopBack framework. It allows developers to interact with MongoDB databases using LoopBack models and APIs. This package is widely used in Node.js applications that require MongoDB integration. However, versions prior to 3.6.0 are vulnerable to NoSQL Injection.

Vulnerability Detail

NoSQL Injection is a type of injection attack where an attacker can manipulate the input to a NoSQL database query in order to execute unauthorized operations or retrieve sensitive data. In the case of loopback-connector-mongodb, the filters passed to the database query are not properly sanitized, allowing an attacker to inject malicious code that gets executed on the database driver. This can lead to data leakage and potential compromise of the entire database.

How To Fix

Latest published version: 8.0.3 as of 23 Oct 2026 

npm install loopback-connector-mongodb@8.0.3

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

3.6.0

This is the first release that contains the fix.

npm install loopback-connector-mongodb@3.6.0

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Conclusion

NoSQL Injection in loopback-connector-mongodb is a critical vulnerability that can lead to data leakage and compromise of the entire database. It is crucial to upgrade to version 3.6.0 or later to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for loopback-connector-mongodb →

Share this vulnerability

FAQ

What is NoSQL Injection?

NoSQL Injection is a type of injection attack where an attacker manipulates the input to a NoSQL database query to execute unauthorized operations or retrieve sensitive data.

loopback-connector-mongodb is an npm package that provides a connector for MongoDB in the LoopBack framework, allowing developers to interact with MongoDB databases using LoopBack models and APIs.

NoSQL Injection in loopback-connector-mongodb can lead to data leakage and compromise of the entire database. Attackers can execute unauthorized operations and retrieve sensitive data.

To fix the vulnerability, upgrade to version 3.6.0 or later of loopback-connector-mongodb. Make sure to update the package.json file and install the latest version of the package.

No workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed version.

References

Related vulnerabilities

Recent vulnerabilities recorded for loopback-connector-mongodb.

View all loopback-connector-mongodb vulnerabilities →
Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

How To Fix

Latest published version: 8.0.3 as of 23 Oct 2026 

npm install loopback-connector-mongodb@8.0.3

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

3.6.0

This is the first release that contains the fix.

npm install loopback-connector-mongodb@3.6.0

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →
Help improve this record
Report an issue or send feedback