EUVD-2026-83190
GHSA-8899-fxx7-fwx3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the AT:P precondition that the app must forward untrusted keys; PR:N/UI:N per unauthenticated reach; C:N since no data disclosure, I:H/A:H for record removal and hang.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
4DescriptionCVE.org
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.
AnalysisAI
Unsafe reflection (CWE-470) in Mongoid's document persistence layer allows a crafted key to be reflected into an internal method invocation instead of the intended array-field update, which can delete stored records and render the embedding application unresponsive. The affected component is Mongoid, MongoDB's Ruby object-document mapper; the CPE record (cpe:2.3:a:mongodb_inc.:mongoid:*:*:*:*:*:*:*) carries no version bounds, so the vendor has not published a bounded version range, and exposure applies to any embedding application that forwards unauthenticated, attacker-controlled keys directly into an array-field update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the embedding application to pass unauthenticated, attacker-controlled input keys directly through to Mongoid's document persistence layer for an array field update, where a crafted key is unsafely reflected into an internal method invocation (CWE-470). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine integrity/availability concern rather than a confidentiality problem, and the vendor's own tag ('Information Disclosure') contradicts its own CVSS 4.0 vector (VC:N - no confidentiality impact; VI:H/VA:H - high integrity and availability). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis; the only tracking reference provided is MongoDB JIRA MONGOID-5973 (https://jira.mongodb.org/browse/MONGOID-5973), so the first action is to monitor that issue for an exact fixed release and treat the CPE's wildcard version as covering all installed Mongoid versions until MongoDB publishes a bounded advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using Mongoid and identify any code paths that accept unauthenticated, attacker-controlled keys and pass them into array-field update operations; if such paths exist, temporarily disable or restrict those endpoints and add strict allowlisting and validation for keys and update operators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Ruby before 2.4.3 allows Net::FTP command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injectio
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call
Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Rated critical severi
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Rated critical severity (CVSS 9.8), this vulnerabilit
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Rub
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) w
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and tru
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated
Share
External POC / Exploit Code
Leaving vuln.today