Description

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-11T19:17:25.670Z",
  "pubdate": "2026-08-11T19:17:25.670Z",
  "executiveSummary": "An improper control of generation of code or injection vulnerability exists within the MongoDB Server JavaScript scripting engine. This security flaw enables an authenticated user possessing write privileges to inject and execute arbitrary attacker-controlled code within the active query execution scope of other distinct database users. The malicious payload is triggered via a specially crafted stored value that is subsequently processed during an internal database maintenance cycle. Successful exploitation leads directly to the corruption of query results impacting concurrent users, as well as localized denial of service conditions specifically targeted at their operations executed against the same database instance. The security impact of this vulnerability is inherently restricted to the boundaries of the scripting engine's execution sandbox, ensuring that the exploit payload cannot escape to gain unauthorized access to underlying host operating system filesystems, network resources, or external database internals. Exploitation requires prior authentication to the database system along with specific write privileges, and relies on the asynchronous processing of stored values during scheduled or triggered internal maintenance operations.",
  "technicalDetails": "The vulnerability resides within the MongoDB Server JavaScript scripting engine component, specifically concerning how stored JavaScript values or expressions are handled, cached, or evaluated during internal maintenance cycles. The vulnerable component fails to properly isolate or sanitize stored values processed asynchronously, allowing malicious state or code structures to persist within the database storage layers. The root cause stems from insufficient contextual segregation within the query scope evaluation pipeline, wherein data processed during routine internal maintenance routines can inappropriately cross execution boundaries and bleed into the query context of independent user sessions.\nTo execute an attack, an authenticated adversary must first provision or modify a stored value within the database using standard write privileges. This malicious stored value is crafted to include specific programmatic constructs designed for execution within the scripting engine. Subsequently, when the MongoDB Server initiates an internal maintenance cycle, the database engine processes the poisoned stored value. During this processing phase, the attacker-controlled logic is injected into the execution context. When other users subsequently execute queries that intersect with or trigger the tainted evaluation scope, the injected code executes with the query scope of those victims.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the MongoDB Server with write privileges. 2) The attacker writes a specially crafted malicious value into a database collection or stored procedure mechanism. 3) The server initiates an internal maintenance cycle which evaluates or processes the stored value. 4) A victim user initiates a database query that invokes or passes through the affected execution scope. 5) The attacker's controlled code executes within the victim's query scope, corrupting the returned query results and inducing a denial of service for the victim's database operations. Post-exploitation impact is strictly bound to the scripting engine sandbox, preventing privilege escalation, host filesystem traversal, or arbitrary network access."
}