EUVD-2026-56915
GHSA-6xq3-wv9f-p92j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Write privileges required (PR:L); sandbox eliminates confidentiality impact (C:N); scope changes because other users' query contexts are affected (S:C).
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.
AnalysisAI
MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject code into the query execution scope of other database users via a specially crafted stored value processed during an internal maintenance cycle. Affected versions span the 7.0, 8.0, and 8.3 release lines, with vendor-confirmed patches available. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; however, the cross-user integrity and availability impact warrants prompt patching in multi-tenant or shared database environments.
Technical ContextAI
CWE-94 (Improper Control of Generation of Code) describes the root cause: MongoDB's server-side JavaScript engine - historically used for features such as $where queries, mapReduce, and stored JavaScript functions - processes stored values during an internal maintenance cycle without sufficient isolation between user execution contexts. When a crafted value is written to a collection, it is later evaluated by the scripting engine in a shared context, allowing the attacker's code to interfere with the query scope of concurrent or subsequent users. The CPE identifier cpe:2.3:a:mongodb:mongodb_server covers all editions across the 7.0, 8.0, and 8.3 lines. Critically, the description notes that MongoDB's scripting sandbox prevents escalation to the underlying database, filesystem, or network - meaning this is a cross-user code injection within the engine's runtime, not a full sandbox escape.
RemediationAI
Upgrade to MongoDB Server 7.0.40, 8.0.29, or 8.3.8 as applicable to your release line; these versions are confirmed by vendor data as containing the fix. The vendor issue tracker at https://jira.mongodb.org/browse/SERVER-130167 should be consulted for any supplementary guidance. If immediate patching is not feasible, disabling server-side JavaScript execution is an effective compensating control: set security.javascriptEnabled: false in the mongod configuration file or launch mongod with the --noscripting flag. The trade-off is that this disables the $where query operator, the $function aggregation operator, mapReduce with JavaScript reducers, and any stored JavaScript functions - applications relying on these features will require refactoring before the flag can be applied. Additionally, enforcing least-privilege write access - ensuring only trusted accounts hold write permissions on shared collections - limits the attacker pool without requiring a service restart.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today