EUVD-2026-47783Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable by any authenticated low-privilege user (PR:L, AC:L); scope changes to host OS (S:C) with high confidentiality impact on filesystem; no integrity or availability impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.
AnalysisAI
MongoDB Server's bundled MozJS (SpiderMonkey) scripting engine unconditionally registers a module loading hook that permits JavaScript code - executing inside aggregation pipeline stages - to read arbitrary files from the host filesystem using the mongod process's OS-level privileges. Any authenticated database user with permission to run JavaScript-enabled aggregation stages can craft pipeline commands to exfiltrate sensitive host files such as private keys, configuration files, or application secrets, bypassing MongoDB's own role-based access controls. No public exploit code or CISA KEV listing exists at time of analysis, but low attack complexity and a default-enabled attack surface make this a meaningful threat in any deployment with untrusted or broadly-credentialed users.
Technical ContextAI
MongoDB Server embeds the MozJS (Mozilla SpiderMonkey) JavaScript engine to support server-side scripting features including the aggregation pipeline's $function and $accumulator stages, the $where query operator, and the legacy mapReduce command. The root cause class is CWE-862 (Missing Authorization): the module loading hook registered by MozJS at engine startup performs no authorization check before permitting file I/O operations, meaning any JavaScript executing within that engine context can invoke file-reading capabilities without restriction. Critically, this hook is registered unconditionally - it activates whenever the scripting engine initializes, regardless of MongoDB user role or privilege level. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N) models the impact correctly: the vulnerable system (MongoDB) itself suffers no direct data exposure, but the subsequent system (the host OS filesystem) faces a high confidentiality impact because mongod reads files with its own OS-level service account privileges. No CPE strings were included in the available data, so exact affected version ranges cannot be independently confirmed.
RemediationAI
No specific patched version has been identified in the available data - the only reference is the MongoDB Jira ticket at https://jira.mongodb.org/browse/SERVER-128832, and no vendor advisory with a fixed release number was provided; monitor that ticket and MongoDB's security advisories page for patch release information. As an immediate compensating control, disable server-side JavaScript execution entirely by setting security.javascriptEnabled: false in the mongod configuration file or passing --noscripting at startup - this removes the MozJS engine and fully eliminates the attack surface, but note it disables the $where operator, mapReduce, and the $function/$accumulator aggregation stages, which may break existing application functionality. If disabling JavaScript is not feasible, restrict aggregation pipeline execution permissions to only trusted, internally-controlled service accounts using MongoDB's role-based access control, minimizing the set of principals who could craft malicious pipeline commands. Audit existing database users for unnecessary aggregation or scripting permissions and revoke where possible.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to cras
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr
A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today