CVE-2026-93759
HighCVSS 8.6Summary
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.
Risk Assessment
The risk includes the possibility of arbitrary JavaScript execution in the database, which may lead to data leakage, data manipulation, and disruption of database operations.
Recommendation
It is recommended to avoid passing user input as string query criteria and to use parameterized queries or proper validation.
Other vulnerabilities in Mongoid
See all- CVE-2026-93764Medium
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning.
- CVE-2026-93763Medium
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning.
- CVE-2026-93761High
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.
- CVE-2026-93760High
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
- CVE-2026-93758High
A vulnerability in Mongoid (object-document mapper) involves an insecure direct object reference in nested attributes handling. A user with basic privileges can reference a record identifier that is not their own, causing the record to be looked up without usual ownership restrictions, then updated and linked to the attacker's record.
- CVE-2026-93762Critical
Mongoid has an unsafe reflection weakness in the query path for embedded documents. An application passing an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored data and permanently remove records.
- CVE-2026-93765Critical
Mongoid contains an unsafe reflection weakness in the document persistence layer. Passing keys from unauthenticated parties can trigger unintended internal method invocation instead of an array update, potentially causing deletion of stored records and unresponsiveness.
Original NVD description (English source)
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.