CVE-2026-93765

Mongoid (Ruby ODM for MongoDB) has an unsafe reflection weakness in the document persistence layer. Unvalidated method-name dispatch in the atomic pop operation allows an unauthenticated party—via keys passed through an embedding application—to trigger unintended internal method invocations inste...

CVE-2026-93765 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...

CVE-2026-93765 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...