Mongoid
Monthly
Code injection in Mongoid allows unauthenticated attackers who can influence a query argument to execute arbitrary JavaScript in the MongoDB server via a string-typed query criterion, leading to disclosure of stored field values, unintended document selection for writes, and reduced database performance. The vulnerability affects Mongoid versions 8.0.0 through 8.0.12, 8.1.0 through 8.1.12, 9.0.0 through 9.0.11, and 9.1.0, but exploitation requires the application to pass externally influenced string criteria to the query builder and the MongoDB deployment to permit server-side JavaScript evaluation. No public exploit identified at time of analysis.
Unauthenticated, remote query-operator injection in Mongoid - the official MongoDB object-document mapper for Ruby - allows an attacker to shape how MongoDB evaluates a query whenever an application forwards externally supplied filter parameters straight into Mongoid query-building methods without whitelisting allowed operators. Successful abuse can disclose stored field values (for example through $ne, $gt or $regex-style filter logic used for blind extraction) and, because operators such as $regex or $where can force expensive scans, can degrade database performance. The impact is conditional: the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) and our assessment uses AC:H, because exploitation depends entirely on the downstream application's query-construction pattern rather than on a Mongoid setting. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. CVSS 4.0 base is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L) and our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. high confidentiality impact with a limited availability effect and no integrity impact.
CPU exhaustion in MongoDB's Mongoid Ruby ODM allows an unauthenticated remote party to render an embedding application unresponsive by supplying crafted text that lands inside a pattern-matching query condition Mongoid evaluates in memory against an embedded association, triggering catastrophic regex backtracking (CWE-1333, ReDoS). The impact is availability-only: the affected Ruby application process burns CPU and stops responding, with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and reachability depends on a specific application coding pattern, which is why the independent assessment applies AC:H and treats deployments that never route untrusted input into regex conditions on embedded documents as out of scope (the CNA's CVSS 4.0 vector rates it 8.7 with AC:L, a more aggressive reading than the assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Data disclosure and permanent record deletion in Mongoid can be triggered by an unauthenticated remote attacker when an application passes an externally supplied field name to certain in-memory query methods for embedded documents, exploiting an unsafe reflection weakness (CWE-470). The vendor CVSS 4.0 base score of 9.2 reflects the network vector and high impact across confidentiality, integrity, and availability, though the attack requires a developer-dependent data flow (AT:P) where untrusted input reaches a field name parameter. No public exploit code or active exploitation has been identified at time of analysis, and affected/fixed versions remain unconfirmed due to an unbounded CPE (mongoid:*).
Silent, warning-free failure of encryption-configuration generation in the Mongoid object-document mapper causes fields that an application explicitly declared for client-side field-level encryption (CSFLE) to be written to MongoDB as cleartext, allowing any party with ordinary read access to the database - a DBA, a read replica, a backup, or a lower-privilege account with query rights - to read values that were intended to be protected from them. Only applications built on Mongoid that use MongoDB CSFLE and declare fields for encryption are affected; the CVSS vectors (the supplied 4.0 vector with PR:L and the independently assessed 3.1 vector with PR:L) indicate the attacker requires some existing privilege, consistent with the assessed precondition of ordinary database read access rather than an unauthenticated remote path. No public exploit code has been identified at time of analysis, and this is assessed as a genuine but conditional data-protection failure rather than an actively exploited priority.
Mongoid can silently persist values in readable form that applications intended to encrypt, because its client-side field-level encryption (CSFLE) schema generation omits encryption rules for fields declared on embedded models - the MongoDB driver then writes those values unencrypted with no error or warning. The exposure is limited to applications that both enable CSFLE and declare encrypted fields on embedded documents (top-level fields are not implicated), and to parties who already hold read access to the database, a backup, or the underlying on-disk data files; there is no write, integrity, or availability impact and no remote code execution. Data-level risk is real but bounded: no public exploit code identified at time of analysis, no confirmed active exploitation, and the reported CVSS 4.0 base score of 7.1 is consistent with the independent CVSS 3.1 assessment of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Unsafe reflection (CWE-470) in Mongoid's document persistence layer allows a crafted key to be reflected into an internal method invocation instead of the intended array-field update, which can delete stored records and render the embedding application unresponsive. The affected component is Mongoid, MongoDB's Ruby object-document mapper; the CPE record (cpe:2.3:a:mongodb_inc.:mongoid:*:*:*:*:*:*:*) carries no version bounds, so the vendor has not published a bounded version range, and exposure applies to any embedding application that forwards unauthenticated, attacker-controlled keys directly into an array-field update. The CVSS 4.0 vector marks this dependency as AT:P (Attack Requirements: Present), meaning Mongoid is not exploitable in isolation, but where that non-default coding pattern exists there is no authentication or user-interaction barrier (PR:N, UI:N/A:H). Impact is integrity and availability only (VI:H/VA:H, VC:N), and no public exploit code has been identified at time of analysis.
Insecure direct object reference in Mongoid's nested-attributes handling lets an authenticated user with basic application privileges supply another user's record identifier, causing Mongoid to look up that record outside ownership or tenant scoping and then update and link it to the requester's own record-resulting in unintended disclosure and unauthorized modification of data. Exploitation is limited to applications that use accept_nested_attributes_for on ownership- or tenant-scoped associations and rely on Mongoid to enforce scoping; no public exploit identified at time of analysis, and no confirmed affected or fixed versions because the only reference is an unbounded MongoDB Jira advisory with a wildcard CPE.
Code injection in Mongoid allows unauthenticated attackers who can influence a query argument to execute arbitrary JavaScript in the MongoDB server via a string-typed query criterion, leading to disclosure of stored field values, unintended document selection for writes, and reduced database performance. The vulnerability affects Mongoid versions 8.0.0 through 8.0.12, 8.1.0 through 8.1.12, 9.0.0 through 9.0.11, and 9.1.0, but exploitation requires the application to pass externally influenced string criteria to the query builder and the MongoDB deployment to permit server-side JavaScript evaluation. No public exploit identified at time of analysis.
Unauthenticated, remote query-operator injection in Mongoid - the official MongoDB object-document mapper for Ruby - allows an attacker to shape how MongoDB evaluates a query whenever an application forwards externally supplied filter parameters straight into Mongoid query-building methods without whitelisting allowed operators. Successful abuse can disclose stored field values (for example through $ne, $gt or $regex-style filter logic used for blind extraction) and, because operators such as $regex or $where can force expensive scans, can degrade database performance. The impact is conditional: the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) and our assessment uses AC:H, because exploitation depends entirely on the downstream application's query-construction pattern rather than on a Mongoid setting. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. CVSS 4.0 base is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L) and our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. high confidentiality impact with a limited availability effect and no integrity impact.
CPU exhaustion in MongoDB's Mongoid Ruby ODM allows an unauthenticated remote party to render an embedding application unresponsive by supplying crafted text that lands inside a pattern-matching query condition Mongoid evaluates in memory against an embedded association, triggering catastrophic regex backtracking (CWE-1333, ReDoS). The impact is availability-only: the affected Ruby application process burns CPU and stops responding, with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and reachability depends on a specific application coding pattern, which is why the independent assessment applies AC:H and treats deployments that never route untrusted input into regex conditions on embedded documents as out of scope (the CNA's CVSS 4.0 vector rates it 8.7 with AC:L, a more aggressive reading than the assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Data disclosure and permanent record deletion in Mongoid can be triggered by an unauthenticated remote attacker when an application passes an externally supplied field name to certain in-memory query methods for embedded documents, exploiting an unsafe reflection weakness (CWE-470). The vendor CVSS 4.0 base score of 9.2 reflects the network vector and high impact across confidentiality, integrity, and availability, though the attack requires a developer-dependent data flow (AT:P) where untrusted input reaches a field name parameter. No public exploit code or active exploitation has been identified at time of analysis, and affected/fixed versions remain unconfirmed due to an unbounded CPE (mongoid:*).
Silent, warning-free failure of encryption-configuration generation in the Mongoid object-document mapper causes fields that an application explicitly declared for client-side field-level encryption (CSFLE) to be written to MongoDB as cleartext, allowing any party with ordinary read access to the database - a DBA, a read replica, a backup, or a lower-privilege account with query rights - to read values that were intended to be protected from them. Only applications built on Mongoid that use MongoDB CSFLE and declare fields for encryption are affected; the CVSS vectors (the supplied 4.0 vector with PR:L and the independently assessed 3.1 vector with PR:L) indicate the attacker requires some existing privilege, consistent with the assessed precondition of ordinary database read access rather than an unauthenticated remote path. No public exploit code has been identified at time of analysis, and this is assessed as a genuine but conditional data-protection failure rather than an actively exploited priority.
Mongoid can silently persist values in readable form that applications intended to encrypt, because its client-side field-level encryption (CSFLE) schema generation omits encryption rules for fields declared on embedded models - the MongoDB driver then writes those values unencrypted with no error or warning. The exposure is limited to applications that both enable CSFLE and declare encrypted fields on embedded documents (top-level fields are not implicated), and to parties who already hold read access to the database, a backup, or the underlying on-disk data files; there is no write, integrity, or availability impact and no remote code execution. Data-level risk is real but bounded: no public exploit code identified at time of analysis, no confirmed active exploitation, and the reported CVSS 4.0 base score of 7.1 is consistent with the independent CVSS 3.1 assessment of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Unsafe reflection (CWE-470) in Mongoid's document persistence layer allows a crafted key to be reflected into an internal method invocation instead of the intended array-field update, which can delete stored records and render the embedding application unresponsive. The affected component is Mongoid, MongoDB's Ruby object-document mapper; the CPE record (cpe:2.3:a:mongodb_inc.:mongoid:*:*:*:*:*:*:*) carries no version bounds, so the vendor has not published a bounded version range, and exposure applies to any embedding application that forwards unauthenticated, attacker-controlled keys directly into an array-field update. The CVSS 4.0 vector marks this dependency as AT:P (Attack Requirements: Present), meaning Mongoid is not exploitable in isolation, but where that non-default coding pattern exists there is no authentication or user-interaction barrier (PR:N, UI:N/A:H). Impact is integrity and availability only (VI:H/VA:H, VC:N), and no public exploit code has been identified at time of analysis.
Insecure direct object reference in Mongoid's nested-attributes handling lets an authenticated user with basic application privileges supply another user's record identifier, causing Mongoid to look up that record outside ownership or tenant scoping and then update and link it to the requester's own record-resulting in unintended disclosure and unauthorized modification of data. Exploitation is limited to applications that use accept_nested_attributes_for on ownership- or tenant-scoped associations and rely on Mongoid to enforce scoping; no public exploit identified at time of analysis, and no confirmed affected or fixed versions because the only reference is an unbounded MongoDB Jira advisory with a wildcard CPE.