How severe is CVE-2026-93759?

CVE-2026-93759 has a CVSS 3.x base score of 8.6, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability low.

Is CVE-2026-93759 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-93759?

CVE-2026-93759 primarily affects Mongodb Mongoid. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-93759?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-93759 published?

CVE-2026-93759 was published on 2026-09-18 and last updated on 2026-09-24.

CVE-2026-93759

CVE-2026-93759 is a high-severity vulnerability in Mongodb Mongoid with a CVSS 3.x base score of 8.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Severity: High (CVSS 3.x base score 8.6)
CVSS v4: 8.8
EPSS exploit prediction: 0% (36th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-94
Affected product: Mongodb Mongoid
Published: 2026-09-18
Last modified: 2026-09-24

Description

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.

Frequently asked questions

What is CVE-2026-93759?: Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.
How severe is CVE-2026-93759?: CVE-2026-93759 has a CVSS 3.x base score of 8.6, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability low.
Is CVE-2026-93759 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-93759?: CVE-2026-93759 primarily affects Mongodb Mongoid. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-93759?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-93759 published?: CVE-2026-93759 was published on 2026-09-18 and last updated on 2026-09-24.

References

https://jira.mongodb.org/browse/MONGOID-5993

Affected products (2)

cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:*

More vulnerabilities in Mongodb Mongoid

CVE-2026-93762 — Critical (CVSS 9.8): Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that…
CVE-2026-93765 — Critical (CVSS 9.1): Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code.…
CVE-2026-93760 — High (CVSS 8.2): Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands…
CVE-2026-93758 — High (CVSS 8.1): An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a…
CVE-2026-93761 — High (CVSS 7.5): An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library…
CVE-2026-93764 — Medium (CVSS 6.5): Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level…

All CVEs affecting Mongodb Mongoid →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-105857 — Critical (CVSS 10.0): Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions…
CVE-2026-55107 — Critical (CVSS 10.0): Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted…
CVE-2026-96349 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
CVE-2026-102425 — Critical (CVSS 10.0): Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa…
CVE-2026-89275 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability…
CVE-2026-84412 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability…

Browse all CWE-94 (Code Injection) vulnerabilities →