CVE-2026-93760: high-severity vulnerability in MongoDB Inc. Mongoid
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.3epss 0.5%
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
MongoDB Inc. · MongoidRelated CVEs — MongoDB Inc. Mongoid
In the same product, most dangerous first.
CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.6%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.5%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.5%CVE-2026-93759HIGHServer-side JavaScript injection via string query criteria bypassing the strict operator allowlistEPSS 0.4%CVE-2026-93758HIGHCross-principal document update, theft, and deletion via unvalidated id in nested attributesEPSS 0.4%CVE-2026-93763HIGHSilent plaintext persistence via unresolved callable database name in encryption schema mapEPSS 0.2%