Executive brief
cve-search is a tool used to import and search Common Vulnerabilities and Exposures (CVE) data. A security flaw in its web interface allows an unauthenticated attacker to bypass intended restrictions and access the underlying database. This could lead to the theft of sensitive information, including administrative usernames and password hashes, potentially allowing an attacker to take full control of the system.
Technical details
An unauthenticated NoSQL injection vulnerability exists in the POST /fetch_cve_data endpoint of cve-search. The application fails to properly validate request parameters—specifically 'retrieve', 'columns', and pagination fields—before using them in MongoDB queries. A remote attacker can manipulate these parameters to control the target collection, field projections, and filters. This allows for arbitrary data extraction from the database, including the 'mgmt_users' collection containing administrative password hashes. The vulnerability also enables pagination-based denial-of-service attacks. A fix was merged into the master branch on June 22, 2026, which implements strict allowlist-based validation for collections and fields.
Affected products
- cve-search cve-search All versions prior to June 22, 2026 commit d02681b
Timeline
- 2026-06-22: patched: Fix merged into master branch via Pull Request 1218
- 2026-07-05: disclosed: CVE published