Executive brief
Mongoid, a MongoDB object-mapping library, fails to sanitize string inputs in database query construction, allowing an unauthenticated attacker to inject arbitrary server-side JavaScript code. An attacker exploiting this can access sensitive data in the database, manipulate which records are modified, or degrade database performance through malicious code execution.
Technical details
Mongoid passes unsanitized string-typed query criteria directly to MongoDB as server-side JavaScript expressions without neutralization. An unauthenticated remote attacker able to control query parameters can inject arbitrary code that executes in the database engine context, bypassing application logic. This results in unintended data disclosure, document selection manipulation, and potential denial of service via resource exhaustion.
Affected products
- MongoDB Mongoid <UNKNOWN>
Timeline
- 2026-09-18: disclosed