NoSQL Injection
High · Injection
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-943
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-943
Definition
Operators injected into MongoDB-style queries.
Root cause
JSON body bound directly to query.
Affected components
- Components in the “Injection” class
- Application / API handlers
- Supporting libraries
Impact
Auth bypass, data leak.
Severity
High · CVSS 8.1
Safe lab reproduction
NoSQLi labs
Detection methodology
Operator injection ($ne, $gt) tests.
Evidence examples
- Lab reproduction notes: NoSQLi labs
- Request/response excerpts (redacted)
- Detection signal: Operator injection ($ne, $gt) tests
Remediation
Schema validation; type-safe ODM usage.
Secure coding examples
Reject unexpected operators in filters.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.