⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Security rules for MongoDB queries and interactions (NoSQL injection).

• Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
• How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
• What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚

oxlint / Vite+ — the same rules under the same mongodb-security/<rule> IDs, without ESLint:

npm install oxlint-plugin-mongodb-security --save-dev

// .oxlintrc.json
{ "jsPlugins": ["oxlint-plugin-mongodb-security"] }

// vite.config.ts
import { defineConfig } from 'vite-plus';

export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-mongodb-security'] } });

ESLint:

npm install eslint-plugin-mongodb-security --save-dev

⚙️ Configuration Presets

| Preset | Description | | :------------ | :------------------------------------------------ | | recommended | Critical rules as errors, high as warnings | | strict | All rules as errors | | mongoose | Specialized rules for Mongoose ODM usage patterns |

📚 Supported Libraries

| Library | npm | Downloads | Detection | | ---------- | ------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ---------------------------- | | mongodb | | | Injection, Unbounded Queries | | mongoose | | | Schema Safety, Leans |

🏢 Usage Examples

Prevent NoSQL Injection (no-operator-injection)

// ❌ Incorrect (Vulnerable to { $ne: null })
User.findOne({ email: req.body.email, password: req.body.password });

// ✅ Correct (Safe execution)
User.findOne({ email: { $eq: email }, password: { $eq: password } });

Prevent JavaScript Injection (no-unsafe-where)

// ❌ Incorrect (Allows RCE)
User.find({ $where: `this.name === '${userInput}'` });

// ✅ Correct (Standard operators)
User.find({ name: { $eq: sanitize(userInput) } });

📦 Compatibility

| Package | Version | | :--- | :--- | | ESLint | ^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0 | | Node.js | >=18.0.0 |

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

| Icon | Description | | :---: | :--- | | 💼 | Recommended: Included in the recommended preset. | | ⚠️ | Warns: Set to warn in recommended preset. | | 🔧 | Auto-fixable: Automatically fixable by the --fix CLI option. | | 💡 | Suggestions: Providing code suggestions in IDE. | | 🚫 | Deprecated: This rule is deprecated. | | 🟢 | Type-unaware: AST-only, runs in oxlint JS-plugin tier. | | 🟡 | Type-aware (refining): pure-AST primary path; types refine precision. | | 🟠 | Type-aware (graceful): requires TS program; silent without it. |

| Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 | | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: | :---: | | no-bypass-middleware | CWE-284 | A01:2021 | | Detects Mongoose operations that bypass middleware hooks (pre/post hooks). | 🟢 | | ⚠️ | | | | | no-debug-mode-production | CWE-489 | A05:2021 | | Detects Mongoose debug mode that could expose sensitive query information in production. | 🟢 | 💼 | | | 💡 | | | no-hardcoded-connection-string | CWE-798 | A07:2021 | | Detects hardcoded MongoDB connection strings containing credentials in source code. | 🟢 | 💼 | | | | | | no-hardcoded-credentials | CWE-798 | A07:2021 | | Detects hardcoded MongoDB authentication credentials in connection options. | 🟢 | 💼 | | | | | | no-operator-injection | CWE-943 | A03:2021 | | Detects MongoDB operator injection attacks where user input is passed directly as query values, allowing at… | 🟢 | 💼 | | | | | | no-select-sensitive-fields | CWE-200 | A01:2021 | | Detects queries that may return sensitive fields like passwords, tokens, or API keys. | 🟢 | | ⚠️ | | | | | no-unbounded-find | CWE-400 | A04:2021 | | Requires limit() on find queries to prevent resource exhaustion from unbounded result sets. | 🟢 | | ⚠️ | | 💡 | | | no-unsafe-populate | CWE-943 | A03:2021 | | Detects user-controlled populate() paths that could lead to data exposure or injection. | 🟢 | 💼 | | | | | | no-unsafe-query | CWE-943 | A03:2021 | | Prevents NoSQL injection by detecting direct use of user input in MongoDB query objects. | 🟢 | 💼 | | | 💡 | | | no-unsafe-regex-query | CWE-400 | A03:2021 | | Detects user input in MongoDB $regex operators that could cause ReDoS (Regular Expression Denial of Service… | 🟢 | 💼 | | | | | | no-unsafe-where | CWE-943 | A01:2021 | | Prevents use of the dangerous $where operator which executes JavaScript on the MongoDB server, enabling Rem… | 🟢 | 💼 | | | | | | require-auth-mechanism | CWE-287 | A07:2021 | | Requires explicit authentication mechanism specification for MongoDB connections. | 🟢 | | ⚠️ | | | | | require-lean-queries | CWE-400 | A04:2021 | | Suggests using .lean() for read-only Mongoose queries to reduce memory usage. | 🟢 | | | | 💡 | | | require-projection | CWE-200 | A01:2021 | | Requires field projection on queries to minimize data exposure. | 🟢 | | | | | | | require-schema-validation | CWE-20 | A04:2021 | | Requires validation options on Mongoose schema fields to prevent invalid or malicious data. | 🟢 | | ⚠️ | | | | | require-tls-connection | CWE-295 | A02:2021 | | Requires TLS/SSL encryption for MongoDB connections in production environments. | 🟢 | | ⚠️ | | 💡 | |

🔗 Related ESLint Plugins

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

| Plugin | Downloads | Description | | :--- | :---: | :--- | | eslint-plugin-anthropic-security | | Anthropic SDK security. | | eslint-plugin-browser-security | | XSS, DOM security. | | eslint-plugin-drizzle-security | | Drizzle security. | | eslint-plugin-express-security | | Express middleware hardening. | | eslint-plugin-gemini-security | | Google Gemini SDK security. | | eslint-plugin-jwt-security | | Token security. | | eslint-plugin-knex-security | | Knex security. | | eslint-plugin-lambda-security | | AWS Lambda hardening. | | eslint-plugin-mcp-sdk-security | | MCP SDK security. | | eslint-plugin-mysql-security | | MySQL security. | | eslint-plugin-nestjs-security | | NestJS framework hardening. | | eslint-plugin-node-security | | Server-side patterns. | | eslint-plugin-openai-security | | OpenAI SDK security. | | eslint-plugin-postgresql-security | | PostgreSQL security. | | eslint-plugin-prisma-security | | Prisma security. | | eslint-plugin-secure-coding | | Injection prevention. | | eslint-plugin-sequelize-security | | Sequelize ORM security. | | eslint-plugin-sqlite-security | | SQLite security. | | eslint-plugin-supabase-security | | Supabase security. | | eslint-plugin-typeorm-security | | TypeORM security. | | eslint-plugin-vercel-ai-security | | AI SDK security. |

Code quality

| Plugin | Downloads | Description | | :--- | :---: | :--- | | eslint-plugin-cli-floor | | CLI floor for commander, yargs and burgee. | | eslint-plugin-conventions | | Team-specific habits and styles. | | eslint-plugin-import-next | | Fast cycle + import-graph analysis. | | eslint-plugin-maintainability | | Cognitive load and clean-code patterns. | | eslint-plugin-modernization | | ESNext migration + syntax evolution. | | eslint-plugin-modularity | | Structural integrity and DDD patterns. | | eslint-plugin-operability | | Production readiness and resource health. | | eslint-plugin-react-a11y | | React accessibility / WCAG. | | eslint-plugin-react-features | | React best practices and optimization. | | eslint-plugin-reliability | | Runtime stability and error safety. |

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

MIT © Ofri Peretz