CVE-2026-2302 - Unsafe Reflection in Mongoid::Criteria.from_hash · CoreCVE

Back Back to CVE browser

MEDIUM

Unsafe Reflection in Mongoid::Criteria.from_hash

Published Feb 10, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.21%

Description

Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code.

Affected products

Vendor MongoDB Inc Product MongoDB Ruby Driver Default
unaffected
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.6.1
- Version
  8.0.0
  Status
  affected
  Constraints
  <=8.0.12
- Version
  8.1.0
  Status
  affected
  Constraints
  <=8.1.12
- Version
  9.0.0
  Status
  affected
  Constraints
  <=9.0.10

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MongoDB Ruby Driver

unaffected

Version	Status	Constraints
7.0.0	affected	<=7.6.1
8.0.0	affected	<=8.0.12
8.1.0	affected	<=8.1.12
9.0.0	affected	<=9.0.10

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-183

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6762		Advisory
https://jira.mongodb.org/browse/MONGOID-5919

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mongodb

Published Feb 10, 2026

Updated Feb 27, 2026

Reserved Feb 10, 2026

Link CVE-2026-2302

CISA Vulnrichment

Updated Feb 10, 2026

Status Deferred

Modified Jun 17, 2026

Link CVE-2026-2302

Severity n/a

Public date n/a

Links CVE-2026-2302

Assigner mongodb

Published Feb 10, 2026

Updated Feb 27, 2026

Exploited since n/a

Link EUVD-2026-6762