CVE-2026-88022

CVE-2026-88022 is an improper neutralization flaw (CWE-943) in the MongoDB integration for Laravel, where an array supplied as the value of an explicit equality filter can be interpreted as a query condition rather than as a literal value. It is triggered through the three-argument `where` method when the operator is '=' or 'eq', and through the `find` and `delete` methods that share that code path, whenever an application passes an attacker-influenced operator-shaped array into these APIs. An attacker who can control such input may cause the query to return a document other than the intended one or delete documents beyond the intended target, producing a low-confidentiality but high-integrity/availability impact (CVSS 4.0: 8.4 High, network vector, no privileges or user interaction required, but with a present attack requirement that the attacker reach the filter). Any Laravel application using MongoDB's official Laravel integration and passing user-controlled arrays into these equality-filter APIs is affected. No public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation have been reported.

What to do: Upgrade to the patched release once MongoDB's advisory specifies it (no fixed version is stated in the source data) and verify the exact package/version in your dependency tree. Until then, audit code paths that pass user-controlled values as the third argument of where() with '=' or 'eq', or into find()/delete(), and normalize or validate attacker input to literal (non-array, non-operator-shaped) values before it reaches equality filters. Note that exploitation requires attacker influence over the filter value, so reviewing whether such input is user-controllable in your application will quickly narrow your actual risk.