CVE-2026-93762: critical vulnerability in MongoDB Inc. Mongoid
Data deletion and attribute disclosure via field-name method injection in in-memory queries
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.6%
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
MongoDB Inc. · MongoidRelated CVEs — MongoDB Inc. Mongoid
In the same product, most dangerous first.
CVE-2026-93760HIGHNoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardEPSS 0.5%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.5%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.5%CVE-2026-93759HIGHServer-side JavaScript injection via string query criteria bypassing the strict operator allowlistEPSS 0.4%CVE-2026-93758HIGHCross-principal document update, theft, and deletion via unvalidated id in nested attributesEPSS 0.4%CVE-2026-93763HIGHSilent plaintext persistence via unresolved callable database name in encryption schema mapEPSS 0.2%