CVE-2026-93765highCWE-470

CVE-2026-93765: fallo de gravedad alta en MongoDB Inc. Mongoid

Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Mongoid

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.3epss 0.5%
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
MongoDB Inc. · Mongoid
CVEs relacionadas — MongoDB Inc. Mongoid

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.6%CVE-2026-93760HIGHNoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardEPSS 0.5%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.5%CVE-2026-93759HIGHServer-side JavaScript injection via string query criteria bypassing the strict operator allowlistEPSS 0.4%CVE-2026-93758HIGHCross-principal document update, theft, and deletion via unvalidated id in nested attributesEPSS 0.4%CVE-2026-93763HIGHSilent plaintext persistence via unresolved callable database name in encryption schema mapEPSS 0.2%