GHSA-v8w9-2789-6hhr

Deserialization of Untrusted Data in bson

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7610

Packages

Ecosystem	Package	Affected	Fixed in
npm	bson	< 1.1.4	1.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7610 advisory
https://github.com/mongodb/js-bson/commit/3809c1313a7b2a8001065f0271199df9fa3d16a8 web
https://snyk.io/vuln/SNYK-JS-BSON-561052 web