CVE-2026-93760

Mongoid , the Ruby ODM for MongoDB, allows caller-supplied filter data to carry unrestricted query operators when an application forwards externally supplied parameters to its query-building methods. Because the operator guard is unsafe by default , an unauthenticated party can influence how the ...

NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

CVE-2026-93760 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...