Read the docs
TI-2026-63122 Aliases CVE-2026-93760GHSA-mm58-qxpf-v4c7

NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Priority MEDIUM 43CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00532 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoid9.1.0; 9.0.0 – 9.0.11; 8.1.0 – 8.1.12; 8.0.0 – 8.0.12—No fix listedCNA
  • Mongoid VendorMongoDB Affected 9.1.0; 9.0.0 – 9.0.11; 8.1.0 – 8.1.12; 8.0.0 – 8.0.12 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*8.0.0 to before 8.0.13; 8.1.0 to before 8.1.13; 9.0.0 to before 9.0.12VulnerableMongoDB
cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableMongoDB
  • cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.0.13; 8.1.0 to before 8.1.13; 9.0.0 to before 9.0.12 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·MongoDB

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93760
  2. 2026-10-03 Alias added: GHSA-mm58-qxpf-v4c7

References

Other 1

  • TI-2026-63124 Data deletion and attribute disclosure via field-name method injection in in-memory queries CVSS 4.0CRITICAL 9.2
  • TI-2026-63123 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher CVSS 4.0HIGH 8.7
  • TI-2026-63121 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist CVSS 4.0HIGH 8.8
  • TI-2026-63127 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation CVSS 4.0HIGH 8.3
  • TI-2026-63120 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes CVSS 4.0HIGH 8.6
  • TI-2026-63126 Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation CVSS 4.0HIGH 7.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences