Read the docs
TI-2026-63121 Aliases CVE-2026-93759GHSA-vr6j-ghpr-hmgf

Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Priority MEDIUM 44CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoid9.1.0; 9.0.0 – 9.0.11; 8.1.0 – 8.1.12; 8.0.0 – 8.0.12—No fix listedCNA
  • Mongoid VendorMongoDB Affected 9.1.0; 9.0.0 – 9.0.11; 8.1.0 – 8.1.12; 8.0.0 – 8.0.12 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*8.0.0 to before 8.0.13; 8.1.0 to before 8.1.13; 9.0.0 to before 9.0.12VulnerableMongoDB
cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableMongoDB
  • cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.0.13; 8.1.0 to before 8.1.13; 9.0.0 to before 9.0.12 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·MongoDB

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93759
  2. 2026-10-03 Alias added: GHSA-vr6j-ghpr-hmgf

References

Other 1

  • TI-2026-63124 Data deletion and attribute disclosure via field-name method injection in in-memory queries CVSS 4.0CRITICAL 9.2
  • TI-2026-63123 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher CVSS 4.0HIGH 8.7
  • TI-2026-63127 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation CVSS 4.0HIGH 8.3
  • TI-2026-63122 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard CVSS 4.0HIGH 8.3
  • TI-2026-63120 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes CVSS 4.0HIGH 8.6
  • TI-2026-63126 Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation CVSS 4.0HIGH 7.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences