CVE catalog

CVE-2026-88029

Severity: High · CVSS 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Published: Sep 10, 2026, 5:56:25 PM UTC
Updated: Sep 10, 2026, 6:18:13 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.27% · Oct 25, 2026

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pymongo	sid	`4.19.0-1`	fixed
Debian	pymongo	forky	`4.19.0-1`	fixed
Debian	pymongo	trixie	`4.10.1-6`	vulnerable
Debian	pymongo	bookworm	`3.11.0-1+deb12u1`	vulnerable
Cpe	python_driver	Not reported	`4.18.1`	fixed
PyPI	pymongo	Not reported	`0.1.1pre`	vulnerable
PyPI	pymongo	Not reported	`0.1.2pre`	vulnerable
PyPI	pymongo	Not reported	`0.10`	vulnerable
PyPI	pymongo	Not reported	`0.10.1`	vulnerable
PyPI	pymongo	Not reported	`0.10.2`	vulnerable
PyPI	pymongo	Not reported	`0.10.3`	vulnerable
PyPI	pymongo	Not reported	`0.11`	vulnerable
PyPI	pymongo	Not reported	`0.11.1`	vulnerable
PyPI	pymongo	Not reported	`0.11.2`	vulnerable
PyPI	pymongo	Not reported	`0.11.3`	vulnerable
PyPI	pymongo	Not reported	`0.12`	vulnerable
PyPI	pymongo	Not reported	`0.13`	vulnerable
PyPI	pymongo	Not reported	`0.14`	vulnerable
PyPI	pymongo	Not reported	`0.14.1`	vulnerable
PyPI	pymongo	Not reported	`0.14.2`	vulnerable
PyPI	pymongo	Not reported	`0.15`	vulnerable
PyPI	pymongo	Not reported	`0.15.1`	vulnerable
PyPI	pymongo	Not reported	`0.15.2`	vulnerable
PyPI	pymongo	Not reported	`0.16`	vulnerable
PyPI	pymongo	Not reported	`0.1pre`	vulnerable
PyPI	pymongo	Not reported	`0.2pre`	vulnerable
PyPI	pymongo	Not reported	`0.3.1pre`	vulnerable
PyPI	pymongo	Not reported	`0.3pre`	vulnerable
PyPI	pymongo	Not reported	`0.4pre`	vulnerable
PyPI	pymongo	Not reported	`0.5.1pre`	vulnerable
PyPI	pymongo	Not reported	`0.5.2pre`	vulnerable
PyPI	pymongo	Not reported	`0.5.3pre`	vulnerable
PyPI	pymongo	Not reported	`0.5pre`	vulnerable
PyPI	pymongo	Not reported	`0.6`	vulnerable
PyPI	pymongo	Not reported	`0.7`	vulnerable
PyPI	pymongo	Not reported	`0.7.1`	vulnerable
PyPI	pymongo	Not reported	`0.7.2`	vulnerable
PyPI	pymongo	Not reported	`0.8`	vulnerable
PyPI	pymongo	Not reported	`0.8.1`	vulnerable
PyPI	pymongo	Not reported	`0.9`	vulnerable
PyPI	pymongo	Not reported	`0.9.1`	vulnerable
PyPI	pymongo	Not reported	`0.9.2`	vulnerable
PyPI	pymongo	Not reported	`0.9.3`	vulnerable
PyPI	pymongo	Not reported	`0.9.4`	vulnerable
PyPI	pymongo	Not reported	`0.9.5`	vulnerable
PyPI	pymongo	Not reported	`0.9.6`	vulnerable
PyPI	pymongo	Not reported	`0.9.7`	vulnerable
PyPI	pymongo	Not reported	`1.0`	vulnerable
PyPI	pymongo	Not reported	`1.1`	vulnerable
PyPI	pymongo	Not reported	`1.1.1`	vulnerable
PyPI	pymongo	Not reported	`1.1.2`	vulnerable
PyPI	pymongo	Not reported	`1.10`	vulnerable
PyPI	pymongo	Not reported	`1.10.1`	vulnerable
PyPI	pymongo	Not reported	`1.11`	vulnerable
PyPI	pymongo	Not reported	`1.2`	vulnerable
PyPI	pymongo	Not reported	`1.2.1`	vulnerable
PyPI	pymongo	Not reported	`1.3`	vulnerable
PyPI	pymongo	Not reported	`1.4`	vulnerable
PyPI	pymongo	Not reported	`1.5`	vulnerable
PyPI	pymongo	Not reported	`1.5.1`	vulnerable
PyPI	pymongo	Not reported	`1.5.2`	vulnerable
PyPI	pymongo	Not reported	`1.6`	vulnerable
PyPI	pymongo	Not reported	`1.7`	vulnerable
PyPI	pymongo	Not reported	`1.8`	vulnerable
PyPI	pymongo	Not reported	`1.8.1`	vulnerable
PyPI	pymongo	Not reported	`1.9`	vulnerable
PyPI	pymongo	Not reported	`2.0`	vulnerable
PyPI	pymongo	Not reported	`2.0.1`	vulnerable
PyPI	pymongo	Not reported	`2.1`	vulnerable
PyPI	pymongo	Not reported	`2.1.1`	vulnerable
PyPI	pymongo	Not reported	`2.2`	vulnerable
PyPI	pymongo	Not reported	`2.2.1`	vulnerable
PyPI	pymongo	Not reported	`2.3`	vulnerable
PyPI	pymongo	Not reported	`2.4`	vulnerable
PyPI	pymongo	Not reported	`2.4.1`	vulnerable
PyPI	pymongo	Not reported	`2.4.2`	vulnerable
PyPI	pymongo	Not reported	`2.5`	vulnerable
PyPI	pymongo	Not reported	`2.5.1`	vulnerable
PyPI	pymongo	Not reported	`2.5.2`	vulnerable
PyPI	pymongo	Not reported	`2.6`	vulnerable
PyPI	pymongo	Not reported	`2.6.1`	vulnerable
PyPI	pymongo	Not reported	`2.6.2`	vulnerable
PyPI	pymongo	Not reported	`2.6.3`	vulnerable
PyPI	pymongo	Not reported	`2.7`	vulnerable
PyPI	pymongo	Not reported	`2.7.1`	vulnerable
PyPI	pymongo	Not reported	`2.7.2`	vulnerable
PyPI	pymongo	Not reported	`2.8`	vulnerable
PyPI	pymongo	Not reported	`2.8.1`	vulnerable
PyPI	pymongo	Not reported	`2.9`	vulnerable
PyPI	pymongo	Not reported	`2.9.1`	vulnerable
PyPI	pymongo	Not reported	`2.9.2`	vulnerable
PyPI	pymongo	Not reported	`2.9.3`	vulnerable
PyPI	pymongo	Not reported	`2.9.4`	vulnerable
PyPI	pymongo	Not reported	`2.9.5`	vulnerable
PyPI	pymongo	Not reported	`3.0`	vulnerable
PyPI	pymongo	Not reported	`3.0.1`	vulnerable
PyPI	pymongo	Not reported	`3.0.2`	vulnerable
PyPI	pymongo	Not reported	`3.0.3`	vulnerable
PyPI	pymongo	Not reported	`3.1`	vulnerable
PyPI	pymongo	Not reported	`3.1.1`	vulnerable
PyPI	pymongo	Not reported	`3.10.0`	vulnerable
PyPI	pymongo	Not reported	`3.10.1`	vulnerable
PyPI	pymongo	Not reported	`3.11.0`	vulnerable
PyPI	pymongo	Not reported	`3.11.1`	vulnerable
PyPI	pymongo	Not reported	`3.11.2`	vulnerable
PyPI	pymongo	Not reported	`3.11.3`	vulnerable
PyPI	pymongo	Not reported	`3.11.4`	vulnerable
PyPI	pymongo	Not reported	`3.12.0`	vulnerable
PyPI	pymongo	Not reported	`3.12.1`	vulnerable
PyPI	pymongo	Not reported	`3.12.2`	vulnerable
PyPI	pymongo	Not reported	`3.12.3`	vulnerable
PyPI	pymongo	Not reported	`3.13.0`	vulnerable
PyPI	pymongo	Not reported	`3.2`	vulnerable
PyPI	pymongo	Not reported	`3.2.1`	vulnerable
PyPI	pymongo	Not reported	`3.2.2`	vulnerable
PyPI	pymongo	Not reported	`3.3.0`	vulnerable
PyPI	pymongo	Not reported	`3.3.1`	vulnerable
PyPI	pymongo	Not reported	`3.4.0`	vulnerable
PyPI	pymongo	Not reported	`3.5.0`	vulnerable
PyPI	pymongo	Not reported	`3.5.1`	vulnerable
PyPI	pymongo	Not reported	`3.6.0`	vulnerable
PyPI	pymongo	Not reported	`3.6.1`	vulnerable
PyPI	pymongo	Not reported	`3.7.0`	vulnerable
PyPI	pymongo	Not reported	`3.7.1`	vulnerable
PyPI	pymongo	Not reported	`3.7.2`	vulnerable
PyPI	pymongo	Not reported	`3.8.0`	vulnerable
PyPI	pymongo	Not reported	`3.9.0`	vulnerable
PyPI	pymongo	Not reported	`4.0`	vulnerable
PyPI	pymongo	Not reported	`4.0.1`	vulnerable
PyPI	pymongo	Not reported	`4.0.2`	vulnerable
PyPI	pymongo	Not reported	`4.1.0`	vulnerable
PyPI	pymongo	Not reported	`4.1.1`	vulnerable
PyPI	pymongo	Not reported	`4.10.0`	vulnerable
PyPI	pymongo	Not reported	`4.10.1`	vulnerable
PyPI	pymongo	Not reported	`4.11`	vulnerable
PyPI	pymongo	Not reported	`4.11.1`	vulnerable
PyPI	pymongo	Not reported	`4.11.2`	vulnerable
PyPI	pymongo	Not reported	`4.11.3`	vulnerable
PyPI	pymongo	Not reported	`4.12.0`	vulnerable
PyPI	pymongo	Not reported	`4.12.1`	vulnerable
PyPI	pymongo	Not reported	`4.13.0`	vulnerable
PyPI	pymongo	Not reported	`4.13.0.dev0`	vulnerable
PyPI	pymongo	Not reported	`4.13.1`	vulnerable
PyPI	pymongo	Not reported	`4.13.2`	vulnerable
PyPI	pymongo	Not reported	`4.14.0`	vulnerable
PyPI	pymongo	Not reported	`4.14.1`	vulnerable
PyPI	pymongo	Not reported	`4.15.0`	vulnerable
PyPI	pymongo	Not reported	`4.15.1`	vulnerable
PyPI	pymongo	Not reported	`4.15.2`	vulnerable
PyPI	pymongo	Not reported	`4.15.3`	vulnerable
PyPI	pymongo	Not reported	`4.15.4`	vulnerable
PyPI	pymongo	Not reported	`4.15.5`	vulnerable
PyPI	pymongo	Not reported	`4.16.0`	vulnerable
PyPI	pymongo	Not reported	`4.16.0.dev0`	vulnerable
PyPI	pymongo	Not reported	`4.17.0`	vulnerable
PyPI	pymongo	Not reported	`4.18.0`	vulnerable
PyPI	pymongo	Not reported	`4.2.0`	vulnerable
PyPI	pymongo	Not reported	`4.3.2`	vulnerable
PyPI	pymongo	Not reported	`4.3.3`	vulnerable
PyPI	pymongo	Not reported	`4.4.0`	vulnerable
PyPI	pymongo	Not reported	`4.4.0b0`	vulnerable
PyPI	pymongo	Not reported	`4.4.1`	vulnerable
PyPI	pymongo	Not reported	`4.5.0`	vulnerable
PyPI	pymongo	Not reported	`4.6.0`	vulnerable
PyPI	pymongo	Not reported	`4.6.1`	vulnerable
PyPI	pymongo	Not reported	`4.6.2`	vulnerable
PyPI	pymongo	Not reported	`4.6.3`	vulnerable
PyPI	pymongo	Not reported	`4.7.0`	vulnerable
PyPI	pymongo	Not reported	`4.7.1`	vulnerable
PyPI	pymongo	Not reported	`4.7.2`	vulnerable
PyPI	pymongo	Not reported	`4.7.3`	vulnerable
PyPI	pymongo	Not reported	`4.8.0`	vulnerable
PyPI	pymongo	Not reported	`4.8.0b0`	vulnerable
PyPI	pymongo	Not reported	`4.9`	vulnerable
PyPI	pymongo	Not reported	`4.9.1`	vulnerable
PyPI	pymongo	Not reported	`4.9.2`	vulnerable
PyPI	pymongo	Not reported	`4.18.1`	fixed
PyPI	pymongo	Not reported	`0.1.1pre`	vulnerable
PyPI	pymongo	Not reported	`0.1.2pre`	vulnerable
PyPI	pymongo	Not reported	`0.10`	vulnerable
PyPI	pymongo	Not reported	`0.10.1`	vulnerable
PyPI	pymongo	Not reported	`0.10.2`	vulnerable
PyPI	pymongo	Not reported	`0.10.3`	vulnerable
PyPI	pymongo	Not reported	`0.11`	vulnerable
PyPI	pymongo	Not reported	`0.11.1`	vulnerable
PyPI	pymongo	Not reported	`0.11.2`	vulnerable
PyPI	pymongo	Not reported	`0.11.3`	vulnerable
PyPI	pymongo	Not reported	`0.12`	vulnerable
PyPI	pymongo	Not reported	`0.13`	vulnerable
PyPI	pymongo	Not reported	`0.14`	vulnerable
PyPI	pymongo	Not reported	`0.14.1`	vulnerable
PyPI	pymongo	Not reported	`0.14.2`	vulnerable
PyPI	pymongo	Not reported	`0.15`	vulnerable
PyPI	pymongo	Not reported	`0.15.1`	vulnerable
PyPI	pymongo	Not reported	`0.15.2`	vulnerable
PyPI	pymongo	Not reported	`0.16`	vulnerable
PyPI	pymongo	Not reported	`0.1pre`	vulnerable
PyPI	pymongo	Not reported	`0.2pre`	vulnerable
PyPI	pymongo	Not reported	`0.3.1pre`	vulnerable
PyPI	pymongo	Not reported	`0.3pre`	vulnerable
PyPI	pymongo	Not reported	`0.4pre`	vulnerable
PyPI	pymongo	Not reported	`0.5.1pre`	vulnerable
PyPI	pymongo	Not reported	`0.5.2pre`	vulnerable
PyPI	pymongo	Not reported	`0.5.3pre`	vulnerable
PyPI	pymongo	Not reported	`0.5pre`	vulnerable
PyPI	pymongo	Not reported	`0.6`	vulnerable
PyPI	pymongo	Not reported	`0.7`	vulnerable
PyPI	pymongo	Not reported	`0.7.1`	vulnerable
PyPI	pymongo	Not reported	`0.7.2`	vulnerable
PyPI	pymongo	Not reported	`0.8`	vulnerable
PyPI	pymongo	Not reported	`0.8.1`	vulnerable
PyPI	pymongo	Not reported	`0.9`	vulnerable
PyPI	pymongo	Not reported	`0.9.1`	vulnerable
PyPI	pymongo	Not reported	`0.9.2`	vulnerable
PyPI	pymongo	Not reported	`0.9.3`	vulnerable
PyPI	pymongo	Not reported	`0.9.4`	vulnerable
PyPI	pymongo	Not reported	`0.9.5`	vulnerable
PyPI	pymongo	Not reported	`0.9.6`	vulnerable
PyPI	pymongo	Not reported	`0.9.7`	vulnerable
PyPI	pymongo	Not reported	`1.0`	vulnerable
PyPI	pymongo	Not reported	`1.1`	vulnerable
PyPI	pymongo	Not reported	`1.1.1`	vulnerable
PyPI	pymongo	Not reported	`1.1.2`	vulnerable
PyPI	pymongo	Not reported	`1.10`	vulnerable
PyPI	pymongo	Not reported	`1.10.1`	vulnerable
PyPI	pymongo	Not reported	`1.11`	vulnerable
PyPI	pymongo	Not reported	`1.2`	vulnerable
PyPI	pymongo	Not reported	`1.2.1`	vulnerable
PyPI	pymongo	Not reported	`1.3`	vulnerable
PyPI	pymongo	Not reported	`1.4`	vulnerable
PyPI	pymongo	Not reported	`1.5`	vulnerable
PyPI	pymongo	Not reported	`1.5.1`	vulnerable
PyPI	pymongo	Not reported	`1.5.2`	vulnerable
PyPI	pymongo	Not reported	`1.6`	vulnerable
PyPI	pymongo	Not reported	`1.7`	vulnerable
PyPI	pymongo	Not reported	`1.8`	vulnerable
PyPI	pymongo	Not reported	`1.8.1`	vulnerable
PyPI	pymongo	Not reported	`1.9`	vulnerable
PyPI	pymongo	Not reported	`2.0`	vulnerable
PyPI	pymongo	Not reported	`2.0.1`	vulnerable
PyPI	pymongo	Not reported	`2.1`	vulnerable
PyPI	pymongo	Not reported	`2.1.1`	vulnerable
PyPI	pymongo	Not reported	`2.2`	vulnerable
PyPI	pymongo	Not reported	`2.2.1`	vulnerable
PyPI	pymongo	Not reported	`2.3`	vulnerable
PyPI	pymongo	Not reported	`2.4`	vulnerable
PyPI	pymongo	Not reported	`2.4.1`	vulnerable
PyPI	pymongo	Not reported	`2.4.2`	vulnerable
PyPI	pymongo	Not reported	`2.5`	vulnerable
PyPI	pymongo	Not reported	`2.5.1`	vulnerable
PyPI	pymongo	Not reported	`2.5.2`	vulnerable
PyPI	pymongo	Not reported	`2.6`	vulnerable
PyPI	pymongo	Not reported	`2.6.1`	vulnerable
PyPI	pymongo	Not reported	`2.6.2`	vulnerable
PyPI	pymongo	Not reported	`2.6.3`	vulnerable
PyPI	pymongo	Not reported	`2.7`	vulnerable
PyPI	pymongo	Not reported	`2.7.1`	vulnerable
PyPI	pymongo	Not reported	`2.7.2`	vulnerable
PyPI	pymongo	Not reported	`2.8`	vulnerable
PyPI	pymongo	Not reported	`2.8.1`	vulnerable
PyPI	pymongo	Not reported	`2.9`	vulnerable
PyPI	pymongo	Not reported	`2.9.1`	vulnerable
PyPI	pymongo	Not reported	`2.9.2`	vulnerable
PyPI	pymongo	Not reported	`2.9.3`	vulnerable
PyPI	pymongo	Not reported	`2.9.4`	vulnerable
PyPI	pymongo	Not reported	`2.9.5`	vulnerable
PyPI	pymongo	Not reported	`3.0`	vulnerable
PyPI	pymongo	Not reported	`3.0.1`	vulnerable
PyPI	pymongo	Not reported	`3.0.2`	vulnerable
PyPI	pymongo	Not reported	`3.0.3`	vulnerable
PyPI	pymongo	Not reported	`3.1`	vulnerable
PyPI	pymongo	Not reported	`3.1.1`	vulnerable
PyPI	pymongo	Not reported	`3.10.0`	vulnerable
PyPI	pymongo	Not reported	`3.10.1`	vulnerable
PyPI	pymongo	Not reported	`3.11.0`	vulnerable
PyPI	pymongo	Not reported	`3.11.1`	vulnerable
PyPI	pymongo	Not reported	`3.11.2`	vulnerable
PyPI	pymongo	Not reported	`3.11.3`	vulnerable
PyPI	pymongo	Not reported	`3.11.4`	vulnerable
PyPI	pymongo	Not reported	`3.12.0`	vulnerable
PyPI	pymongo	Not reported	`3.12.1`	vulnerable
PyPI	pymongo	Not reported	`3.12.2`	vulnerable
PyPI	pymongo	Not reported	`3.12.3`	vulnerable
PyPI	pymongo	Not reported	`3.13.0`	vulnerable
PyPI	pymongo	Not reported	`3.2`	vulnerable
PyPI	pymongo	Not reported	`3.2.1`	vulnerable
PyPI	pymongo	Not reported	`3.2.2`	vulnerable
PyPI	pymongo	Not reported	`3.3.0`	vulnerable
PyPI	pymongo	Not reported	`3.3.1`	vulnerable
PyPI	pymongo	Not reported	`3.4.0`	vulnerable
PyPI	pymongo	Not reported	`3.5.0`	vulnerable
PyPI	pymongo	Not reported	`3.5.1`	vulnerable
PyPI	pymongo	Not reported	`3.6.0`	vulnerable
PyPI	pymongo	Not reported	`3.6.1`	vulnerable
PyPI	pymongo	Not reported	`3.7.0`	vulnerable
PyPI	pymongo	Not reported	`3.7.1`	vulnerable
PyPI	pymongo	Not reported	`3.7.2`	vulnerable
PyPI	pymongo	Not reported	`3.8.0`	vulnerable
PyPI	pymongo	Not reported	`3.9.0`	vulnerable
PyPI	pymongo	Not reported	`4.0`	vulnerable
PyPI	pymongo	Not reported	`4.0.1`	vulnerable
PyPI	pymongo	Not reported	`4.0.2`	vulnerable
PyPI	pymongo	Not reported	`4.1.0`	vulnerable
PyPI	pymongo	Not reported	`4.1.1`	vulnerable
PyPI	pymongo	Not reported	`4.10.0`	vulnerable
PyPI	pymongo	Not reported	`4.10.1`	vulnerable
PyPI	pymongo	Not reported	`4.11`	vulnerable
PyPI	pymongo	Not reported	`4.11.1`	vulnerable
PyPI	pymongo	Not reported	`4.11.2`	vulnerable
PyPI	pymongo	Not reported	`4.11.3`	vulnerable
PyPI	pymongo	Not reported	`4.12.0`	vulnerable
PyPI	pymongo	Not reported	`4.12.1`	vulnerable
PyPI	pymongo	Not reported	`4.13.0`	vulnerable
PyPI	pymongo	Not reported	`4.13.0.dev0`	vulnerable
PyPI	pymongo	Not reported	`4.13.1`	vulnerable
PyPI	pymongo	Not reported	`4.13.2`	vulnerable
PyPI	pymongo	Not reported	`4.14.0`	vulnerable
PyPI	pymongo	Not reported	`4.14.1`	vulnerable
PyPI	pymongo	Not reported	`4.15.0`	vulnerable
PyPI	pymongo	Not reported	`4.15.1`	vulnerable
PyPI	pymongo	Not reported	`4.15.2`	vulnerable
PyPI	pymongo	Not reported	`4.15.3`	vulnerable
PyPI	pymongo	Not reported	`4.15.4`	vulnerable
PyPI	pymongo	Not reported	`4.15.5`	vulnerable
PyPI	pymongo	Not reported	`4.16.0`	vulnerable
PyPI	pymongo	Not reported	`4.16.0.dev0`	vulnerable
PyPI	pymongo	Not reported	`4.17.0`	vulnerable
PyPI	pymongo	Not reported	`4.18.0`	vulnerable
PyPI	pymongo	Not reported	`4.2.0`	vulnerable
PyPI	pymongo	Not reported	`4.3.2`	vulnerable
PyPI	pymongo	Not reported	`4.3.3`	vulnerable
PyPI	pymongo	Not reported	`4.4.0`	vulnerable
PyPI	pymongo	Not reported	`4.4.0b0`	vulnerable
PyPI	pymongo	Not reported	`4.4.1`	vulnerable
PyPI	pymongo	Not reported	`4.5.0`	vulnerable
PyPI	pymongo	Not reported	`4.6.0`	vulnerable
PyPI	pymongo	Not reported	`4.6.1`	vulnerable
PyPI	pymongo	Not reported	`4.6.2`	vulnerable
PyPI	pymongo	Not reported	`4.6.3`	vulnerable
PyPI	pymongo	Not reported	`4.7.0`	vulnerable
PyPI	pymongo	Not reported	`4.7.1`	vulnerable
PyPI	pymongo	Not reported	`4.7.2`	vulnerable
PyPI	pymongo	Not reported	`4.7.3`	vulnerable
PyPI	pymongo	Not reported	`4.8.0`	vulnerable
PyPI	pymongo	Not reported	`4.8.0b0`	vulnerable
PyPI	pymongo	Not reported	`4.9`	vulnerable
PyPI	pymongo	Not reported	`4.9.1`	vulnerable
PyPI	pymongo	Not reported	`4.9.2`	vulnerable
PyPI	pymongo	Not reported	`4.18.1`	fixed
Opensuse	python-pymongo	tumbleweed	`4.18.1-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pymongo	source	sid	`4.18.1-1`	not yet assigned	Not reported	[1147408]
Debian	pymongo	source	forky	`4.18.1-1`	not yet assigned	Not reported	[1147408]
Debian	pymongo	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1147408]
Debian	pymongo	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1147408]
Cpe	python_driver	cpe	Not reported	`4.18.1`	Not reported	NVD-CVE-2026-88029	Not reported
PyPI	pymongo	PyPI	Not reported	`4.18.1`	Not reported	PYSEC-2026-4294	Not reported
PyPI	pymongo	PyPI	Not reported	`4.18.1`	Not reported	GHSA-8FVV-FGR5-F8CH	Not reported
Opensuse	python-pymongo	rpm	tumbleweed	`4.18.1-1.1`	Not reported	OPENSUSE-SU-2026:11808-1	Not reported

[Debian bug #1147408]

Notes

[trixie] pymongo: Minor issue [bookworm] pymongo: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-bson]Affected
Source package: [pymongo]
Details (2)
- 3.11.0-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
- 3.11.0-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
[python3-bson-ext]Affected
Source package: [pymongo]
Details (1)
- 3.11.0-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
[python3-gridfs]Affected
Source package: [pymongo]
Details (2)
- 3.11.0-1+deb12u1 · all · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
- 3.11.0-1+deb12u1 · all · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
[python3-pymongo]Affected
Source package: [pymongo]
Details (2)
- 3.11.0-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
- 3.11.0-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
[python3-pymongo-ext]Affected
Source package: [pymongo]
Details (1)
- 3.11.0-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
[python-pymongo-doc]Affected
Source package: [pymongo]
Details (2)
- 3.11.0-1+deb12u1 · all · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12
- 3.11.0-1+deb12u1 · all · bookworm
  Affected
  nvd · pymongo · debian · bookworm; nvd · pymongo · debian · 12

[Debian 13 (Trixie)]

[python3-bson]Affected
Source package: [pymongo]
Details (2)
- 4.10.1-6 · all · trixie
  Affected
  nvd · pymongo · debian · 13
- 4.10.1-6 · all · trixie
  Affected
  nvd · pymongo · debian · 13
[python3-bson-ext]Affected
Source package: [pymongo]
Details (2)
- 4.10.1-6 · amd64 · trixie
  Affected
  nvd · pymongo · debian · 13
- 4.10.1-6 · arm64 · trixie
  Affected
  nvd · pymongo · debian · 13
[python3-gridfs]Affected
Source package: [pymongo]
Details (2)
- 4.10.1-6 · all · trixie
  Affected
  nvd · pymongo · debian · 13
- 4.10.1-6 · all · trixie
  Affected
  nvd · pymongo · debian · 13
[python3-pymongo]Affected
Source package: [pymongo]
Details (2)
- 4.10.1-6 · all · trixie
  Affected
  nvd · pymongo · debian · 13
- 4.10.1-6 · all · trixie
  Affected
  nvd · pymongo · debian · 13
[python3-pymongo-ext]Affected
Source package: [pymongo]
Details (2)
- 4.10.1-6 · amd64 · trixie
  Affected
  nvd · pymongo · debian · 13
- 4.10.1-6 · arm64 · trixie
  Affected
  nvd · pymongo · debian · 13
[python-pymongo-doc]Affected
Source package: [pymongo]
Details (2)
- 4.10.1-6 · all · trixie
  Affected
  nvd · pymongo · debian · 13
- 4.10.1-6 · all · trixie
  Affected
  nvd · pymongo · debian · 13

[openSUSE Tumbleweed]

[python313-pymongo]Unknown
Source package: [python-pymongo]
Details (1)
- 4.17.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.18.1-1.1
  Version impact unknown
  nvd · python-pymongo · opensuse · tumbleweed
[python314-pymongo]Unknown
Source package: [python-pymongo]
Details (1)
- 4.17.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 4.18.1-1.1
  Version impact unknown
  nvd · python-pymongo · opensuse · tumbleweed

Observed: Oct 23, 2026, 9:28:26 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]