Publish Advisories

GHSA-jxr4-4prv-mh83
GHSA-f5w3-73h4-jpcm
GHSA-jxr4-4prv-mh83

advisories/github-reviewed/2024/07/GHSA-jxr4-4prv-mh83/GHSA-jxr4-4prv-mh83.json

@@ -0,0 +1,66 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jxr4-4prv-mh83",
+  "modified": "2025-02-27T20:59:12Z",
+  "published": "2024-07-01T15:32:47Z",
+  "aliases": [
+    "CVE-2024-6376"
+  ],
+  "summary": "ejson shell parser in MongoDB Compass maybe bypassed",
+  "details": "MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@mongodb-js/connection-form"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.20.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6376"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mongodb-js/compass"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jira.mongodb.org/browse/COMPASS-7496"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20",
+      "CWE-94"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-27T20:59:11Z",
+    "nvd_published_at": "2024-07-01T15:15:17Z"
+  }
+}

advisories/github-reviewed/2025/02/GHSA-f5w3-73h4-jpcm/GHSA-f5w3-73h4-jpcm.json

@@ -1,19 +1,40 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f5w3-73h4-jpcm",
-  "modified": "2025-02-27T18:31:13Z",
+  "modified": "2025-02-27T20:59:00Z",
   "published": "2025-02-27T18:31:13Z",
   "aliases": [
     "CVE-2025-1756"
   ],
-  "details": "mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\\node_modules\\. This issue affects mongosh prior to 2.3.0",
+  "summary": "mongosh vulnerable to local privilege escalation",
+  "details": "mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\\node_modules\\. This issue affects mongosh prior to 2.3.0.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "mongosh"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.3.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -23,6 +44,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2025:1756"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mongodb-js/mongosh"
+    },
     {
       "type": "WEB",
       "url": "https://jira.mongodb.org/browse/MONGOSH-2028"
@@ -33,8 +58,8 @@
       "CWE-426"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-27T20:59:00Z",
     "nvd_published_at": "2025-02-27T16:15:39Z"
   }
 }

advisories/unreviewed/2024/07/GHSA-jxr4-4prv-mh83/GHSA-jxr4-4prv-mh83.json

@@ -1,37 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-jxr4-4prv-mh83",
-  "modified": "2024-07-01T15:32:47Z",
-  "published": "2024-07-01T15:32:47Z",
-  "aliases": [
-    "CVE-2024-6376"
-  ],
-  "details": "MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
-    }
-  ],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6376"
-    },
-    {
-      "type": "WEB",
-      "url": "https://jira.mongodb.org/browse/COMPASS-7496"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-20",
-      "CWE-94"
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-07-01T15:15:17Z"
-  }
-}