CVE-2026-114396: Improper Neutralization of Special Elements in Data Query Logic in polonel trudesk

CVE-2026-114396 describes a server-side JavaScript injection vulnerability in polonel's Trudesk product through version 1.2.11. The flaw arises from improper neutralization of special elements in the data query logic, specifically allowing authenticated users to inject malicious code into the MongoDB $where clause via the search parameter. This injection can be used to terminate the regular expression and execute arbitrary JavaScript within the database query context. Exploitation can lead to denial of service by causing infinite loops in mongod or unauthorized disclosure of sensitive ticket documents including internal notes.

An attacker with authenticated access can exploit this vulnerability to cause denial of service on the database server or leak sensitive internal ticket data. This compromises confidentiality and availability of the affected Trudesk installation.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions and monitor for suspicious query patterns targeting the search endpoint.