Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
Alienbin pastes can be deleted by submitting malicious code
CVE-2026-31827
Summary
A flaw in Alienbin's save endpoint allows an attacker to delete existing pastes by submitting malicious code. This can cause important pastes to be lost, so users should be cautious when submitting code to the service. To stay safe, users should avoid submitting code with a short time-to-live (TTL) setting, and administrators should update to a fixed version of Alienbin.
Original title
Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every n...
Original description
Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every new paste submission. When User B submits a paste with a short TTL (e.g., 30 seconds), the TTL index is recreated with expireAfterSeconds: 30 for all documents in the collection. This causes User A's paste (originally set to 7 days) to be deleted after 30 seconds. An attacker can intentionally delete all existing pastes by repeatedly submitting pastes with ttlOption=30s.
nvd CVSS4.0
7.1
Vulnerability type
CWE-362
Race Condition
Published: 10 Mar 2026 · Updated: 13 Mar 2026 · First seen: 10 Mar 2026