Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · GHSA-jqw5-w6h3-44g6

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

CVSS 5.4 MediumEPSS 0.0030 · 22nd percentile

Published by the GitHub Advisory Database at 20 Oct 2026, 18:19 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
@apostrophecms/import-exportnpm<3.7.03.7.0
Identifiers
GHSA-jqw5-w6h3-44g6 · CVE-2026-113662
Weakness (CWE)
CWE-284 · CWE-943
Tags
Published
20 Oct 2026
Updated
20 Oct 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

The @apostrophecms/import-export npm package, versions before 3.7.0, is affected. An archive can include an update-key property whose value is a MongoDB query operator, such as { $ne: null }, and the import uses that value to match and overwrite an existing document. An attacker needs an authenticated session with import access to the target type, such as the built-in contributor role, and no admin interaction. The source reports that a matched document can be overwritten even when the importer did not specify its identifying field. Upgrade to version 3.7.0 or later.

Written 31 Oct 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
5.4 Medium 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CNA (GitHub_M)
  • CISA KEV Not listed.
  • EPSS 0.0030, the 22nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 31 Oct 2026, 13:33 UTC First seen by agentprime
  2. 31 Oct 2026, 13:33 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.