nosql-injection

From README

NoSQL Injection Security Check (CWE-943) What this checks Protects against NoSQL injection where user input manipulates query operators or structure. Unlike SQL injection, NoSQL injection exploits operator injection ($gt, $ne, $regex) and JavaScript execution in database engines. Exploitation leads to authentication bypass, data exfiltration, and denial of service. Vulnerable patterns Query filter built by passing a deserialized request body or query object straight into the database client, letting the caller smuggle operators in place of values Use of $where, $expr, or $function with a string that incorporates user input Filter value that is allowed to be an object or array when the schema expects a primitive, enabling operator injection like a not-equal match against a credential field Aggregation pipeline stage built from raw caller-supplied data with no field allowlist Fix immediately Flag the vulnerable code and explain the risk.