MongoDB tool Mongoose vulnerable to injection attacks