CVE-2026-13078

Name of the Vulnerable Software and Affected Versions MongoDB Server (affected versions not specified)

Description The server-side MozJS scripting engine unconditionally registers a module loading hook. This allows JavaScript calls to read arbitrary files from the host filesystem using the privileges of the mongod process. An authenticated user can exploit this by using crafted aggregation pipeline commands to access sensitive files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.