AIKIDO-2026-772874

TL;DR

The validateQueryProperty allow-list check in the common adapter query sanitizer does not recurse into array values, and object-valued $or, $and, $select, and $sort filters skip validation. Wrapping a sub-query in an extra array or nesting operators in these filters lets disallowed operators such as $where or $function bypass the operator allow-list and reach the underlying adapter. On a service reachable by untrusted queries this becomes operator injection, and on the in-memory adapter a $where string is compiled with new Function, giving remote code execution from a single unauthenticated request. The fix recurses into arrays and validates the object-valued filter operators.