Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting, leading to regular-expression injection. This flaw could allow an attacker to retrieve unfiltered data or cause query failures that disrupt application availability. The weakness is identified as CWE-624 and CWE-943.

The vulnerability affects Spring Data MongoDB versions 3.4.0 through 3.4.19, 4.0.0 through 4.0.15, 4.1.0 through 4.1.14, 4.2.0 through 4.2.15, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5.

The CVSS score of 5.9 indicates a medium severity flaw, and the EPSS score is < 1%, indicating limited evidence of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires the attacker to supply a crafted regex string to a query that is annotated with @Query; no remote code execution is possible through this vector, but the attack can be performed from any code that can invoke the affected repository methods.