A critical code injection vulnerability in the MongoDB Mongoid ODM allows unauthenticated attackers to execute arbitrary JavaScript within the database engine, risking severe data exposure.

This is a code injection vulnerability (CWE-94) where the query builder fails to neutralize input, allowing an unauthenticated attacker to supply malicious JavaScript expressions that the database executes.

Successful exploitation poses a significant risk to data confidentiality and integrity. An attacker can disclose sensitive stored information, manipulate document selection for unauthorized write operations, and degrade database performance through resource-intensive scripts. Given the CVSS score of 8.6, this vulnerability is categorized as High, reflecting the potential for remote, unauthenticated exploitation that bypasses standard application logic.

Immediate Action: Review the official MongoDB security advisory at https://jira.mongodb.org/browse/MONGOID-5993 and apply the relevant security patches as soon as they are released by the vendor.

Proactive Monitoring: Monitor database query logs for unusual JavaScript syntax or unexpected execution patterns originating from the Mongoid query builder.

Compensating Controls: Implement strict input validation and sanitization for all user-supplied data used in database queries at the application level to prevent injection attempts.

Public Exploit Available: No

Organizations utilizing affected versions of Mongoid must prioritize the transition to a patched version once available. Due to the high severity and the unauthenticated nature of the attack, verify that all external-facing application inputs are properly validated while awaiting vendor-supplied remediation.