AIKIDO-2026-552268
mongodb/laravel-mongodb is vulnerable to NoSQL Injection
71
High Risk
This Affects:
mongodb/laravel-mongodbTL;DR
Embedded-document handling uses caller-supplied record keys and relation identifiers directly as query conditions without rejecting MongoDB operators. A user who controls an embedded record identifier can supply a dollar-prefixed operator array that is interpreted as a query condition rather than a literal key. This lets embedded documents be matched broadly, enabling mass deletion or overwrite of embedded records beyond the intended target. The fix rejects operator arrays used as scalar ids or relation keys.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application lets externally influenced values reach embedded-document keys or relation identifiers.
Background info
mongodb/laravel-mongodb is vulnerable to NoSQL Injection in versions 4.0.0 - 5.10.0.
How to fix this
Upgrade the mongodb/laravel-mongodb library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.