CVE-2026-18708: mongodb

csirt@kutim:~/threat-intel/cve/CVE-2026-18708

CVSS 6.4 · Medium EPSS 0,38%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada mongodb. Skor CVSS 3.1 6.4 (Medium) menurut mongodb.com.

Deskripsi (NVD)

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

Rincian

Terbit di NVD: 11 Agustus 2026
Terakhir diubah: 16 September 2026
Status NVD: Analyzed
CVSS 3.1: 6.4 (Medium), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 0,38% peluang dieksploitasi; lebih tinggi dari 30,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mongodb	mongodb	Versi 7.0.0 hingga sebelum 7.0.40
mongodb	mongodb	Versi 8.0.0 hingga sebelum 8.0.29
mongodb	mongodb	Versi 8.2.0 hingga 8.2.12
mongodb	mongodb	Versi 8.3.0 hingga sebelum 8.3.8
mongodb	mongodb	Versi 9.0.0 alpha0
mongodb	mongodb	Versi 9.0.0 alpha1
mongodb	mongodb	Versi 9.1.0 alpha0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://jira.mongodb.org/browse/SERVER-130167 advisory vendor · issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.