AIKIDO-2026-440922
mongodb/mongodb-extension is vulnerable to Improper Neutralization of Special Elements in Data Query Logic
81
High Risk
This Affects:
mongodb/mongodb-extensionTL;DR
The library builds MongoDB namespace strings by concatenating caller-supplied database and collection names without validating them. Names containing a dot or a NUL byte are interpreted by the server as a different namespace, so supplying untrusted values can redirect an operation to another database or collection. Before the fix this allowed reads and writes against unintended, cross-tenant data sources. The fix rejects dots and NUL bytes in database and collection names and routes affected operations through a centralized namespace-construction helper.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass untrusted values as database or collection names.
Background info
mongodb/mongodb-extension is vulnerable to Improper Neutralization of Special Elements in Data Query Logic in versions 0.0.1 - 1.21.5 and 2.0.0 - 2.4.0.
How to fix this
Upgrade the mongodb/mongodb-extension library to the patch version.
Links
GitHub Releases
github.com/mongodb/mongo-php-driver/releases/tag/1.21.6github.com/mongodb/mongo-php-driver/releases/tag/2.4.1github.com/mongodb/mongo-php-library/releases/tag/1.21.4github.com/mongodb/mongo-php-library/releases/tag/2.4.1
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.