CVE-2026-103965: CWE-94: Improper Control of Generation of Code ('Code Injection') in MongoDB MongoDB Server

This vulnerability involves improper control of code generation (CWE-94) within MongoDB Server's aggregation framework. Specifically, during internal query rewriting, certain constant values can be incorrectly handled, leading to unintended field values being returned in aggregation query results. The flaw requires an authenticated user with read privileges to exploit and does not require user interaction. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required beyond read access, and limited impact on confidentiality and integrity. Affected versions include MongoDB Server versions >=7.0 <7.0.45, >=8.0 <8.0.34, >=8.3.0 <8.3.13, and >=9.0 <9.0.4.

An authenticated user with read access may receive unintended field values in aggregation query outputs, potentially exposing data not intended by the query. The impact is limited to confidentiality and integrity with low severity as per CVSS 4.0. There is no indication of privilege escalation or denial of service. No known exploits are reported in the wild.

No explicit patch links or vendor advisory details are provided in the input. Patch status is not yet confirmed — check the official MongoDB vendor advisory for current remediation guidance. Until patched, restrict read access to trusted users only and monitor for unusual aggregation query results.