GHSA-97mg-3cr6-3x4c: 
JavaScript vulnerability analysis and mitigation

A critical Remote Code Execution (RCE) vulnerability was identified in mongodb-query-parser versions prior to 2.0.0. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 4, 2020, and last updated on January 9, 2023. This security issue affects the mongodb-query-parser npm package (GitHub Advisory, NPM Advisory).

The vulnerability stems from the package's failure to properly sanitize queries, which allows attackers to execute arbitrary code in the system. A proof-of-concept exploit demonstrates that parsing a specially crafted payload can execute system commands, such as '(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'. The vulnerability has been assigned a Critical severity rating (GitHub Advisory).

The vulnerability allows attackers to execute arbitrary code on the affected system, potentially leading to complete system compromise. This could result in unauthorized access, data theft, or system manipulation (GitHub Advisory).

A proof-of-concept exploit exists and has been publicly documented, demonstrating the ability to execute system commands through specially crafted queries. The vulnerability can be triggered by parsing malicious input that leverages the package's query parsing functionality (GitHub Advisory).

Users are strongly recommended to upgrade to mongodb-query-parser version 2.0.0 or later, which contains patches for this vulnerability. This is currently the only known mitigation strategy (GitHub Advisory).