CVE-2026-93760 — NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application th…
Published: 2026-09-18 · CVSS: 8.3 · CVSS 4.0
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7