AIKIDO-2026-715664

TL;DR

MongoDB's PHP driver decodes command monitoring events (CommandStartedEvent, CommandSucceededEvent, CommandFailedEvent, ServerHeartbeatSucceededEvent), write result, session, and error reply payloads with a typemap that uses an embedded __pclass field, so it autoloads and instantiates an application class named in that field without calling its constructor. An application with a registered command monitoring subscriber that includes untrusted input in a database operation, or a compromised server response, causes the resulting object's bsonUnserialize() method to run with untrusted data before the operation reaches the server. Impact depends on which Persistable classes the application can autoload, up to remote code execution through gadget classes. The fix adds a skip_odm state that blocks __pclass inference on these paths while keeping it for explicit debug conversions.