[GHSA-5mrr-rgp6-x4gr] Command Injection in marsdb

[msh0625]

Updates

• Affected products
• CVSS v3
• CWEs
• Description
• References
• Source code location
• Summary

Comments
This improvement adds a verified Proof of Concept (PoC) demonstrating
Arbitrary Code Execution via the $where selector in marsdb.

Evidence:

1. Vulnerable line confirmed at dist/DocumentMatcher.js:419
   selectorValue = Function('obj', 'return ' + selectorValue);
   User input is concatenated directly into Function() constructor
   with no sanitization.

2. PoC verified on:

   • marsdb v0.6.10
   • Node.js v24.16.0 (ACE confirmed - arbitrary JS execution)
   • Node.js <= 18 (full RCE via require('child_process').execSync())

3. Authentication bypass confirmed:
   $where: "1 === 1" matches all documents regardless of other
   query conditions.

4. Repository has been archived since 2019 with no patch available.
   All versions (<=0.6.10) are affected.

Discovered and verified using vulnscope, an AI-assisted open source
vulnerability scanner: https://github.com/msh0625/vulnscope