Trudesk Server-Side JavaScript Injection via Search Parameter

Executive Summary

CVE-2026-114396 is a MongoDB $where injection vulnerability in Trudesk versions up to 1.2.11. Authenticated users can inject malicious JavaScript code into the search parameter, which is then executed in MongoDB queries. This allows attackers to cause denial of service by looping the mongod process or leak sensitive ticket data including internal notes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual MongoDB query patterns or excessive CPU usage from the mongod process. Check Trudesk logs for suspicious search queries containing $where clauses or JavaScript injection attempts in the search parameter. Use network monitoring tools to inspect API requests to /api/v1/tickets/search for payloads like regex closures or malicious JavaScript.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to crash the Trudesk server by overloading the database, or steal confidential ticket information such as internal notes and documents. Since the attack requires authentication, it primarily affects users with access to the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of sensitive personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected Trudesk versions may face compliance violations and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Trudesk to a patched version beyond 1.2.11. If upgrading is not possible, disable the search API endpoint or restrict access to authenticated users with minimal privileges. Implement input validation to sanitize search parameters and block $where clause usage. Monitor for active exploitation attempts and review logs for unauthorized data access.

Useful 0 Not Useful 0