CVE-2026-88022High· 7.7▾ TwilightImproper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Last analysed / modified upstream
Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator is = or eq, as well as the find and delete methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.
laravel_mongodb >= 1.0.0, < 5.11.0Upgrade past the affected range:
laravel_mongodb 5.11.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88027High· 7.1Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query conditi…
CVE-2026-88028Medium· 6.5Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather tha…
CVE-2026-118581Medium· 6.5NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
CVE-2026-114648High· 7.6NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
CVE-2026-114647Medium· 4.3NoSQL operator injection via unvalidated replacement document in findOneAndReplace
CVE-2026-114652Medium· 6.5Update operator injection via single-element list rewriting in the update builder