Malicious Package in mogodb-core - Critical Vulnerability
Summary
GHSA-g4m3-rpxr-h7vg: Malicious Package in mogodb-core. Affects mogodb-core versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mogodb-core is an npm package that provides core functionality for interacting with MongoDB databases. It is widely used in Node.js applications for database operations. However, a critical vulnerability has been discovered in the package that allows for the execution of malicious code.
Vulnerability Detail
The mogodb-core package contained malicious code that uploaded system information, such as the operating system and hostname, to a remote server. This unauthorized data exfiltration can lead to further compromise of the affected system. The vulnerability has a CVSS score of 9.8, indicating its high severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The mogodb-core package has been found to contain a critical vulnerability that allows for the execution of malicious code and unauthorized data exfiltration. To mitigate this risk, it is crucial to remove the package from your environment and consider using alternative packages. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mogodb-core →
FAQ
mogodb-core is an npm package that provides core functionality for interacting with MongoDB databases in Node.js applications.
The malicious package in mogodb-core uploaded system information to a remote server, potentially leading to further compromise of the affected system.
To fix this vulnerability, remove the mogodb-core package from your environment and consider using alternative packages that are not affected.
No specific workaround is available for this vulnerability. Removing the package is the recommended solution.
This vulnerability is classified as critical with a CVSS score of 9.8, indicating its high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for mogodb-core.
