Deserialization of Untrusted Data in bson

严重 9.8CVE-2020-7610 · GHSA-v8w9-2789-6hhr · SNYK-JS-BSON-561052 · Published 30/03/2020 · updated 17/06/2026

要点

CVE-2020-7610 是影响 bson (mongodb), bson 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：2.3%，高于 83.0% 的漏洞。
修复：升级到 1.1.4 或更高版本。

Package	Affected versions	Patched versions
bson mongodb	`≥ 1.0.0, < 1.1.4`	`1.1.4`
bson npm	`< 1.1.4`	`1.1.4`

Description

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.

NVD description

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

References

nvd.nist.gov/vuln/detail/CVE-2020-7610 · ADVISORY
mongodb/js-bson commit 3809c13 · WEB
snyk.io/vuln/SNYK-JS-BSON-561052 · WEB

bson 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free