Executive brief
MongoDB Server contains a vulnerability in its JavaScript scripting engine that allows authenticated users with write privileges to execute malicious code within other users' query contexts. This could result in corrupted query results and denial of service attacks against other database users, though the impact is contained to the scripting sandbox without access to underlying data or system resources.
Technical details
The vulnerability exists in MongoDB's JavaScript scripting engine where delete requests in scope constructs concatenate unsanitized _id fields, allowing code injection. An authenticated attacker with write privileges can craft specially-crafted stored values that are processed during internal maintenance cycles, causing controlled code execution within the query sandbox of other users. The attack requires database authentication and write access; the impact is limited to query result corruption and denial of service within the scripting sandbox, with no access to database files, filesystem, or network resources. Patches are available in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server before 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-08-11: disclosed: CVE-2026-18708 published
- 2026-08-11: patched: Patches released in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0