8.2High
CVE-2026-93760NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
Description
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
Weakness (CWE):
CWE-943
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| MongoDB Inc. | Mongoid | 9.1.0, 9.0.0 – ≤ 9.0.11, 8.1.0 – ≤ 8.1.12, 8.0.0 – ≤ 8.0.12 |
References and patches
CPE matches (NVD) (4)
cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.0.13cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.13cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.12cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:*