{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.5.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "loopback-connector-mongodb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:35:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of `loopback-connector-mongodb` prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.\n\n\n## Recommendation\n\nUpgrade to version 3.6.0 or later.",
  "id": "GHSA-hxwc-5vw9-2w4w",
  "modified": "2021-09-27T15:13:26Z",
  "published": "2020-09-02T15:52:39Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://github.com/loopbackio/loopback-connector-mongodb"
    },
    {
      "type": "WEB",
      "url": "https://loopback.io/doc/en/lb3/Security-advisory-08-15-2018.html"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/767"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "NoSQL Injection in loopback-connector-mongodb"
}