CVE-2026-18708

Awaiting Analysis Awaiting Analysis - Queue

JavaScript Code Execution in MongoDB Server

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18708

EUVD

EUVD-2026-56915

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to execute controlled code within the query scope of other users. This happens when a specially crafted stored value is processed during an internal maintenance cycle, potentially corrupting query results for others and causing denial of service.

Detection Guidance

Detection requires monitoring for unusual JavaScript execution patterns in MongoDB logs. Check for stored values triggering internal maintenance cycles with unexpected code execution. Review logs for queries involving the scripting engine with corrupted results or denial of service events targeting user operations.

Impact Analysis

If exploited, this vulnerability could lead to incorrect query results for other users, disrupting their database operations. It may also cause denial of service targeted at specific users' activities on the same database. The impact is limited to the scripting engine's sandbox and does not grant access to database, filesystem, or network resources.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized code execution within the query scope of other users. This may lead to data integrity issues or denial of service, which could violate confidentiality and availability requirements under these regulations.

Mitigation Strategies

Update MongoDB Server to the latest patched version immediately to address the JavaScript scripting engine issue. Restrict write privileges to trusted users only and monitor database operations for unusual activity.

Hi! I’m here to help you understand CVE-2026-18708. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70