Mongoid::Criteria.from_hash can perform an unsafe reflection operation when a specially crafted Hash is processed, allowing injected code to be executed within the Ruby environment. The flaw enables an attacker to run arbitrary Ruby code on the host running the driver, potentially compromising confidentiality, integrity, and availability of the application and underlying systems.

The vulnerability affects MongoDB Inc’s MongoDB Ruby Driver. No specific affected version range is supplied in the data, so any installation that uses the Criteria.from_hash method and has not applied a later patch may be exposed.

The CVSS base score of 6.9 categorizes the threat as moderate. The EPSS score of <1% indicates that current exploitation activity is very low, but the presence of the flaw in a widely used driver means it could still be leveraged in targeted attacks. The vulnerability is not listed in CISA’s KEV catalog, yet the ability to execute arbitrary Ruby code directly affects system security. Exploits would require an attacker to supply a malicious Hash object to the application – for example, via an API request or internal data ingestion – and the driver must be calling Criteria.from_hash during processing. If the application does not use this API or if input is tightly validated, the attack surface is mitigated.