Code Injection in MongoDB Server - CVE-2026-18708
Published: August 18, 2026
Vulnerability identifier: #VU144141
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18708
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute code within the query scope of other users.
The vulnerability exists due to improper control of code generation in MongoDB Server's JavaScript scripting engine when processing a specially crafted stored value during an internal maintenance cycle. A remote user can store a specially crafted value to execute code within the query scope of other users.
Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.
Affected software
MongoDB Server
How to mitigate CVE-2026-18708
Install security update from vendor's website.
MongoDB Server - addressed in versions 7.0.40, 8.0.29, 8.3.8