Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-2302

Unsafe Reflection in Mongoid::Criteria.from_hash

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc MongoDB Ruby Driver

Default version status: unaffected

  • 7.0.0 to ≤ 7.6.1affected
  • 8.0.0 to ≤ 8.0.12affected
  • 8.1.0 to ≤ 8.1.12affected
  • 9.0.0 to ≤ 9.0.10affected

References