CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
Attackers can inject server-side JavaScript into Mongoid queries, leading to data disclosure and potential code execution on the database.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93759?
CVE-2026-93759 is a high-severity code injection vulnerability in MongoDB Inc. Mongoid, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.
Weakness: CWE-94
Which versions are affected by CVE-2026-93759?
It affects 1 product.
Products include Mongodb Mongoid.
How do I fix CVE-2026-93759?
No fix has been published for CVE-2026-93759 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-93759 being exploited?
There is no known exploitation of CVE-2026-93759 in the wild and no public exploit code.
Other vulnerabilities in MongoDB Inc. Mongoid
- CVE-2026-93762 Data deletion and attribute disclosure via field-name method injection in in-memory queries
- CVE-2026-93761 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
- CVE-2026-93758 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
- CVE-2026-93760 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
- CVE-2026-93765 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
Sources
Also known as GHSA-vr6j-ghpr-hmgf.