Description

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4

Remediation

References

CVE-2025-3084

Related Vulnerabilities

Ruby on Rails Improper Input Validation Vulnerability (CVE-2013-1854)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41164)

WordPress Plugin XEN Carousel Multiple Cross-Site Scripting Vulnerabilities (0.12.2)

WordPress Plugin Token Manager 'tid' Parameter Multiple Cross-Site Scripting Vulnerabilities (1.0.2)

WordPress Plugin SMTP Mailer Cross-Site Request Forgery (1.0.6)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities CWE-703 CVE-2025-3084