An issue in MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject specially crafted stored values that are processed during an internal maintenance cycle. This causes code the attacker controls to execute within the query scope of other users, leading to tampered query results and targeted denial of service against those users’ operations. The vulnerability is limited to the sandboxed scripting environment, which lacks direct access to the database, filesystem, or network resources.

The affected product is MongoDB Server. No specific version information is provided, so all currently installed instances may be susceptible unless a patch has already been applied.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user with write rights; the attacker must craft data that will be executed during maintenance, which is an inferred prerequisite rather than an explicitly stated condition. Exploitation would corrupt data visible to other users and could disrupt operations within the same database.