AIKIDO-2026-321069
pymongo is vulnerable to NoSQL Injection
61
Medium Risk
This Affects:
pymongoTL;DR
GridFS delete, find_one, exists, and rename in both the synchronous and asynchronous drivers pass the caller-supplied file_id (or _id) straight into MongoDB filter documents such as {"_id": file_id}. A file_id shaped as a query operator, for example {"$gt": MinKey()}, is interpreted as MongoDB query syntax instead of a literal value, letting the filter match, delete, rename, or return files beyond the intended id. The fix wraps every such id in $eq ({"_id": {"$eq": file_id}}) across the affected GridFS lookups so operator-shaped ids can no longer alter query semantics.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use GridFS to look up, delete, or rename files by a file id that can be influenced by external input.
Background info
pymongo is vulnerable to NoSQL Injection in versions 3.3.0 - 4.18.0.
How to fix this
Upgrade the pymongo library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.