AIKIDO-2026-90073
mongodb is vulnerable to NoSQL Injection
61
Medium Risk
This Affects:
mongodbTL;DR
GridFS operations in the driver insert caller provided file IDs directly into MongoDB filter documents. A file ID supplied as a document such as { "$gt": MinKey } is interpreted as a query operator rather than a literal value. Download, delete, rename, and upload-cleanup queries then match files and chunks belonging to other files, exposing their contents or removing them. The fix wraps each file ID in $eq so it is always matched as a literal.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes externally influenced file IDs to GridFS download, delete, rename, or upload operations.
Background info
mongodb is vulnerable to NoSQL Injection in versions 2.4.0 - 3.9.0.
How to fix this
Upgrade the mongodb library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.