Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mongodb/mongoid

              master @ 25cfe21
            

Fixes

CVEs

HIGH

Peak severity

40.0%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

lib/rack/mongoid/middleware/identity_map.rb: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Unsafe dynamic method invocation on query building criteria objects using dynamic parameters allows remote execution of arbitrary methods. This risk is tracked under CVE-2026-2302.

SQL Injection: Allowing unpermitted ActionController::Parameters hashes can lead to NoSQL injections or unindexed query denial of service due to insufficient parameter type validation.

Auth Bypass: Lack of strong parameter authorization checks on criteria methods can lead to unpermitted parameter query injection, bypassing authorization policies.