MongoDB Ruby Driver vulnerabilities

Latest MongoDB Ruby Driver CVEs

Newest publication first

1. CVE-2026-88030 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver

   Published 2026-09-10

   Medium·CVSS 6.1

   Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can infl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.