Changelog for #1091

pyeve · Dec 4, 2017 · a5c96d7 · a5c96d7
1 parent 532968d
commit a5c96d7
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/CHANGES b/CHANGES
@@ -11,6 +11,9 @@ Version 0.7.5
 
 Not yet released.
 
+- Fix: A query was not fully traversed in the sanitization. Therefore the
+  blacklist for mongo wueries could be bypassed, allowing for dangerous
+  ``$where`` queries (Moritz Schneider).
 
 Stable
 ------