CVE-2026-93759: MongoDB Mongoid RCE Vulnerability

CVE-2026-93759 Overview

CVE-2026-93759 affects Mongoid, the official Ruby object-document mapper (ODM) for MongoDB. The library does not neutralize a string-typed query criterion supplied to its query builder. Instead, Mongoid passes the string to MongoDB as a server-side JavaScript expression for evaluation. An unauthenticated attacker who can influence the value an application supplies as a query argument may cause arbitrary code to be evaluated by the database engine. Successful exploitation can disclose stored field values, cause unintended document selection during application writes, and degrade database performance. The weakness is classified as Improper Control of Generation of Code [CWE-94].

Critical Impact
Attackers can inject server-side JavaScript into MongoDB queries via Mongoid, exposing stored data and corrupting write targeting without authentication.

Affected Products

MongoDB Mongoid (Ruby ODM)
Mongoid version 9.1.0
Applications using Mongoid query builders that accept externally supplied string criteria

Discovery Timeline

2026-09-18 - CVE-2026-93759 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93759

Vulnerability Analysis

Mongoid exposes a query builder that accepts criteria in multiple types, including hashes, symbols, and strings. When a string is supplied as a criterion, Mongoid forwards that value to MongoDB as a server-side JavaScript expression rather than treating it as an opaque comparison value. MongoDB then evaluates the string through its JavaScript engine ($where semantics), executing whatever logic the string contains against candidate documents.

This behavior converts any application path that concatenates untrusted input into a Mongoid query criterion into a code injection sink. Because evaluation occurs inside the database process, the attacker gains read access to document fields the query touches and can influence which documents subsequent write operations target. Long-running or CPU-intensive JavaScript expressions also degrade throughput for concurrent database clients.

Root Cause

The root cause is missing input neutralization in the Mongoid query builder. String-typed criteria are passed through without being coerced to a safe MongoDB query operator or escaped as literal comparison values. This maps to [CWE-94] Improper Control of Generation of Code.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits crafted input to any application endpoint whose request handler feeds a string into a Mongoid query criterion. When the query executes, MongoDB evaluates the injected JavaScript on the server, returning results that reflect the attacker's logic. See the MongoDB Issue Tracker Entry for the vendor's technical description.

// Verified proof-of-concept code is not publicly available.
// Refer to MONGOID-5993 for the vendor's technical writeup.

Detection Methods for CVE-2026-93759

Indicators of Compromise

MongoDB server logs showing $where operator usage or Code BSON types originating from application traffic that should only issue structured queries.
Unexpected spikes in query latency or CPU on mongod processes correlated with specific HTTP endpoints.
Application logs containing user-supplied strings that later appear inside Mongoid where or Criteria invocations.

Detection Strategies

Perform static analysis of Ruby code for Mongoid calls such as Model.where(user_input) where the argument is a String rather than a Hash.
Enable MongoDB profiling and alert on queries whose command contains $where or Code BSON types.
Correlate application request logs with database slow-query logs to attribute JavaScript-evaluated queries to specific inputs.

Monitoring Recommendations

Baseline normal query shapes per collection and alert on deviations that introduce JavaScript expressions.
Monitor Mongoid dependency versions in Gemfile.lock across deployed services to identify vulnerable installations.
Forward MongoDB audit logs to a centralized analytics platform for retention and correlation with application telemetry.

How to Mitigate CVE-2026-93759

Immediate Actions Required

Inventory all Ruby services using Mongoid and identify any that accept externally supplied values as query criteria.
Refactor query construction to pass structured hashes with explicit operators, never raw strings derived from user input.
Disable server-side JavaScript evaluation on MongoDB deployments where it is not required by starting mongod with --noscripting or setting security.javascriptEnabled: false.

Patch Information

Consult the MongoDB Issue Tracker Entry for fixed-version guidance and upgrade instructions. Upgrade Mongoid to the vendor-designated patched release once available and validate that string-typed criteria are no longer forwarded as JavaScript expressions.

Workarounds

Coerce all query criteria to hashes before invoking Mongoid query methods, and reject String types at a shared query wrapper.
Apply strict input validation and allow-listing on any parameter used to build a query criterion.
Enforce least-privilege MongoDB roles so that compromised queries cannot read collections beyond the application's data scope.

bash

# Disable server-side JavaScript evaluation in mongod.conf
security:
  javascriptEnabled: false