CVE-2026-120819

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server allows an authenticated user with only read privileges to exploit a use-after-free vulnerability (CWE-416). By submitting a specially crafted database command that executes user-supplied JavaScript, an at...