It's interesting to see SQL injection techniques reworked to attack Mongo, but not really surprising. Not following good coding practices is going to cause problems regardless the language. Nosql, SSJS and the like won't protect you from yourself if you don't sanitize user input.