GHSA-f6mq-5m25-4r72MediumCVSS 6.8

go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON

Published
June 15, 2021
Last Modified
September 17, 2024

🔗 CVE IDs covered (1)

📋 Description

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.

🎯 Affected products1

  • go/go.mongodb.org/mongo-driver:< 1.5.1

🔗 References (7)