CVE-2026-93759

Name of the Vulnerable Software and Affected Versions Mongoid (affected versions not specified)

Description The query builder fails to neutralize string-typed query criteria, passing them directly to the database as server-side JavaScript expressions. An unauthenticated party capable of influencing the value supplied as a query argument can inject and execute arbitrary code within the database engine. This can lead to the unauthorized disclosure of stored field values, unintended selection of documents during write operations, and degraded database performance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.