CVE-2026-88022
Description
Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.
How to fix
- mongodb laravel_mongodb5.11.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb laravel_mongodb | 1.0.0 ≤ v < 5.11.0 | 5.11.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.