GitHub Advisoryadvisory · PyPI

GHSA-8fvv-fgr5-f8ch pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

MEDIUM Published 2026-10-05 Modified 2026-10-05 Official page ↗
Aliases
CVE-2026-88029
Ecosystem
PyPI
Packages
pymongo
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-943
Reviewed
2026-10-05

Affected packages

• PyPI pymongo: < 4.18.1 → fixed in 4.18.1

Description

Impact When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match. Patches Patch available in pymongo >= 4.18.1 Workarounds Ensure your existing workflow _only_ supports exact matching on the GridFS API.

Related

Alias · CVE (1)

  • CVE-2026-88029 Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a… vulnerability

Weakness · CWE (1)

  • CWE-943 Improper Neutralization of Special Elements in Data Query Logic weakness

References