NoSQL Injection in Vibe Coded Apps

What is NoSQL injection?

NoSQL injection is a vulnerability where attackers manipulate database queries by injecting operators or objects instead of expected string values. Unlike SQL injection which uses SQL syntax, NoSQL injection exploits JSON-based query operators like $ne, $gt, and $where.

Think of it like a hotel keycard system that accepts commands instead of just room numbers. Instead of entering "Room 203," an attacker types "all rooms where room number is not nothing" and gains access to every room.

According to OWASP Top 10 (2021), injection attacks rank #3 in web application security risks. CWE-943 specifically covers improper neutralization of special elements in data query logic. Many vibe coders assume "NoSQL means no injection," but this is a dangerous myth. The attack vector differs from SQL injection, but the consequences are equally severe.

How does NoSQL injection work?

NoSQL injection works by sending objects where strings are expected, exploiting query operators that databases interpret as commands. The most common attack targets authentication systems using MongoDB's comparison operators.

// Vulnerable code
const user = await db.collection('users').findOne({
  username: req.body.username,
  password: req.body.password
})

// Normal request
{ "username": "admin", "password": "secret123" }

// Attack payload
{ "username": "admin", "password": { "$ne": "" } }
// This matches any password that is not empty - bypasses auth!

// Vulnerable code
db.collection('users').find({
  $where: `this.username == '${username}'`
})

// Attack payload
username = "'; return true; //"
// Executes: this.username == ''; return true; //'
// Returns ALL users in the database!

// Vulnerable code
const doc = await db.collection('users').doc(userId).get()

// Normal request
userId = "user123"

// Attack payload
userId = "../secrets/apikeys"
// Could traverse to other collections depending on implementation

Why do AI tools generate vulnerable NoSQL code?

AI tools generate vulnerable NoSQL code because their training data includes insecure patterns, and NoSQL syntax looks deceptively safe compared to SQL.

// Cursor, Bolt, Claude Code all generate this pattern
app.post('/login', async (req, res) => {
  const user = await db.collection('users').findOne({
    email: req.body.email,
    password: req.body.password  // No type checking!
  })
  if (user) {
    res.json({ token: generateToken(user) })
  }
})

Why this happens:

• Training data bias: AI models learn from codebases where NoSQL validation is often missing
• No SQL keywords: Without obvious SQL syntax like SELECT or WHERE, the code looks safe
• Working over secure: AI prioritizes code that runs without errors, not code that's secure
• Operator injection is obscure: Less documentation exists compared to SQL injection

What could happen if I have NoSQL injection?

NoSQL injection can result in authentication bypass, data theft, denial of service, and in some cases server compromise through JavaScript execution.

• Authentication bypass: Log in as any user without knowing their password using $ne operators
• Data extraction: Use $regex operators to extract data character by character
• Privilege escalation: Modify your own user document to grant admin privileges
• Denial of service: Craft queries that consume excessive resources or crash the database
• Server-side JavaScript execution: MongoDB's $where can execute arbitrary JavaScript

How do I detect NoSQL injection?

Detect NoSQL injection by searching for database queries that use user input without type validation. Any findOne(), find(), or updateOne() that directly uses req.body or req.query is suspicious.

// Direct use of req.body in queries (DANGEROUS)
.findOne({ email: req.body.email, password: req.body.password })

// No type checking before query (DANGEROUS)
const { username, password } = req.body
await collection.findOne({ username, password })

// $where with user input (DANGEROUS)
.find({ $where: `this.field == '${userInput}'` })

// Regex patterns to find these:
// \.find(One)?\s*\(\s*\{[^}]*req\.(body|query|params)
// \$where:\s*[`'"]

How do I fix NoSQL injection?

Fix NoSQL injection by validating input types before queries. Ensure user input is a string (not an object), and never use $where with any user-influenced data.

// Direct use of req.body - DANGEROUS
app.post('/login', async (req, res) => {
  const user = await db.collection('users').findOne({
    username: req.body.username,
    password: req.body.password
  })
  // ...
})

// Attacker sends:
// { "username": "admin", "password": { "$ne": "" } }
// Result: Logs in as admin without knowing password

// Type validation with Zod - SAFE
import { z } from 'zod'

const loginSchema = z.object({
  username: z.string().min(1).max(50),
  password: z.string().min(8)
})

app.post('/login', async (req, res) => {
  // This throws if input isn't a string
  const { username, password } = loginSchema.parse(req.body)

  const user = await db.collection('users').findOne({
    username,
    password
  })
  // ...
})

// Attacker sends { "$ne": "" } for password
// Result: Zod throws "Expected string, received object"

const schema = z.object({
  email: z.string().email(),
  password: z.string()
})

import sanitize from 'mongo-sanitize'
const clean = sanitize(req.body.email)

// Use this instead of $where
db.find({ name: { $eq: name } })

const isValid = /^[a-zA-Z0-9_-]+$/.test(id)

Frequently asked questions

Related content