CVE-2026-93759
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Mongoid
- Vendor
- MongoDB Inc.
- Product
- Mongoid
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 9.1.0 | affected | semver | Unavailable | Unavailable | None listed |
| 9.0.0 | affected | semver | Unavailable | 9.0.11 | None listed |
| 8.1.0 | affected | semver | Unavailable | 8.1.12 | None listed |
| 8.0.0 | affected | semver | Unavailable | 8.0.12 | None listed |