CVE-2026-2302

Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code.

Score

CVSS 4.0 6.9 Medium

Status

Deferred - cna@mongodb.com

Published

2026-02-10

Last modified

2026-02-27

Weaknesses

CWE-183

Affected products

• Mongodb Ruby Driver (Mongodb Inc)

References

• https://jira.mongodb.org/browse/MONGOID-5919