CVE-2026-31827 Details
Description
Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every new paste submission. When User B submits a paste with a short TTL (e.g., 30 seconds), the TTL index is recreated with expireAfterSeconds: 30 for all documents in the collection. This causes User A's paste (originally set to 7 days) to be deleted after 30 seconds. An attacker can intentionally delete all existing pastes by repeatedly submitting pastes with ttlOption=30s.
A vulnerability exists in Alienbin versions through 1.0.0, specifically in the '/save' endpoint of 'server.js'. This issue arises because the endpoint drops and recreates the MongoDB TTL index on the entire post collection with each new paste submission. When a user submits a paste with a short TTL, the index is updated to reflect that short duration for all documents, causing previously set longer-duration pastes to be deleted prematurely. This flaw allows an attacker to delete all existing pastes by repeatedly submitting pastes with a short TTL.
To address this vulnerability, implement a per-document TTL expiration field and use a single TTL index that references this field, allowing each document to expire independently.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 10, 2026CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Blue-B/Alienbin/security/advisories/GHSA-hqvr-6v89-gwff | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Blue-B Alienbin | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |