CVE-2020-7610

—

CVSS 3.1

9.8 critical

EPSS

2%p82

Published

Mar 30, 2020 (Mar 30, 2020)

Modified

Jun 17, 2026

Description

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Vendors: mongodb
Products: bson
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.2%)

In the news0 stories

No ingested article mentions this CVE yet.