CVE-2026-2302 — Unsafe Reflection in Mongoid::Criteria.from_hash

CVE-2026-2302

Unsafe Reflection in Mongoid::Criteria.from_hash PUBLISHED

Description (CNA)

Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code.

Affected (CNA)

Vendor / product	Versions
MongoDB Inc / MongoDB Ruby Driver	affected 7.0.0 through 7.6.1; affected 8.0.0 through 8.0.12; affected 8.1.0 through 8.1.12; affected 9.0.0 through 9.0.10

CWE

No CWE identifiers supplied.

References

https://jira.mongodb.org/browse/MONGOID-5919

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.