| Package | Affected versions | Patched versions |
|---|---|---|
| mongodb | ≥ 7.0.0, < 7.0.35≥ 8.0.0, < 8.0.24≥ 8.2.0, < 8.2.10≥ 8.3.0, < 8.3.3 | 7.0.358.0.248.2.108.3.3 |
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free