CVE-2026-31827
MongoDB TTL Index Misuse in Alienbin Causes Data Loss
Publication date: 2026-03-10
Last updated on: 2026-03-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| alienbin | alienbin | to 1.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Alienbin, an anonymous code and text sharing web service, version 1.0.0 and earlier. The issue is in the /save endpoint of the server.js file, which drops and recreates the MongoDB TTL index on the entire post collection every time a new paste is submitted.
When a user submits a paste with a very short TTL (time-to-live), for example 30 seconds, the TTL index is recreated with that short expiration time for all documents in the collection. This causes all other pastes, even those originally set to expire after a longer period (like 7 days), to be deleted after the short TTL.
An attacker can exploit this by repeatedly submitting pastes with a short TTL, effectively deleting all existing pastes prematurely.
How can this vulnerability impact me? :
This vulnerability can lead to unintended deletion of data. Specifically, legitimate pastes that users expect to persist for a certain duration can be deleted much earlier than intended.
An attacker can exploit this flaw to delete all existing pastes by submitting multiple pastes with very short TTLs, causing data loss and potential disruption of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know