Plugin: mongodb-securityRules
no-unsafe-populate
Detects user-controlled populate() paths that could lead to data exposure or injection.
Detects user-controlled populate() paths that could lead to data exposure or injection.
⚠️ This rule errors by default in the recommended config.
Quick Summary
| Aspect | Details |
|---|---|
| CWE Reference | CWE-943 (NoSQL Injection) |
| CVE | CVE-2025-23061 (Mongoose populate injection) |
| OWASP | A03:2021 - Injection |
| Severity | Medium (CVSS: 6.5) |
| Category | Security |
Rule Details
User-controlled populate() paths can:
- Expose sensitive related documents
- Cause performance issues (deep population)
- Enable injection attacks (CVE-2025-23061)
❌ Incorrect
// User controls which relations to load
User.findById(id).populate(req.query.include);
// Object population with user input
User.findById(id).populate({
path: req.body.path,
select: req.body.fields,
});
// A path built from user input
User.findById(id).populate(`${req.query.relation}`);
User.findById(id).populate([req.query.relation, 'author']);✅ Correct
// Hardcoded paths, inline or named by a const
const AUTHOR = 'author';
User.findById(id).populate(AUTHOR);
User.findById(id).populate(['author', 'comments']);
User.findById(id).populate({ path: 'author', select: 'name' });Known False Negatives
Spread Operator
// ❌ NOT DETECTED
User.findById(id).populate(req.body.populateOptions);When Not To Use It
- When populate paths are strictly validated against an allowlist
References
⚙️ Options
| Option | Type | Default | Description |
|---|---|---|---|
allowInTests | boolean | true | Skip this rule in *.test.* / *.spec.* files |
Use this rule
npm install -D oxlint-plugin-mongodb-security{ "jsPlugins": ["oxlint-plugin-mongodb-security"], "rules": { "mongodb-security/no-unsafe-populate": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-mongodb-security'], rules: { 'mongodb-security/no-unsafe-populate': 'error', }, },});oxlint-plugin-mongodb-security re-exports eslint-plugin-mongodb-security/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.