ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

Summary @apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged...