Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mongodb/laravel-mongodb

              5.x @ ab3044f
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Injection: 2 prior fixes. Scrutinize any change in this area.

src/Jenssegers/Mongodb/Auth/DatabaseTokenRepository.php: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Using a null value when initializing UTCDateTime objects during password reset token creation led to missing timestamps, effectively bypassing the token expiration mechanism. Developers must ensure time-critical MongoDB BSON types are always instantiated with explicit, validated timestamps.

Injection: The unique and multi-count database presence verifiers constructed query filters using raw regular expressions without escaping. This allowed attackers to perform regex injection attacks, potentially causing Denial of Service or leaking data via partial matching.

Credential Exposure: Embedding sensitive credentials directly into plaintext DSN connection strings during MongoClient initialization increases the risk of log exposure and parsing bugs. Credentials must always be passed securely using the native options array of MongoClient.