AIKIDO-2026-11180
spring-data-mongodb is vulnerable to Improper Neutralization of Special Elements in Data Query Logic
59
Medium Risk
This Affects:
spring-data-mongodbTL;DR
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding (e.g., @Query("{ name : /^\Q?0\E$/ }")) perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. When the repository is exposed to untrusted sources (e.g. via spring-data-rest). This can lead to unauthorized data exposure or bypass of intended query filters.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-data-mongodb is vulnerable to Improper Neutralization of Special Elements in Data Query Logic in versions 0.0.0 - 4.5.11 and 5.0.0 - 5.0.5.
How to fix this
Upgrade the org.springframework.data:spring-data-mongodb library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.