GHSA-vp6j-j7w5-5xjj

Suggest an improvement
Source
https://github.com/advisories/GHSA-vp6j-j7w5-5xjj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vp6j-j7w5-5xjj/GHSA-vp6j-j7w5-5xjj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vp6j-j7w5-5xjj
Aliases
Published
2026-10-05T23:47:07Z
Modified
2026-10-06T00:00:09Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Details

Summary

PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.

Impact

An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because %2C and %3A survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.

Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.

Patches

Fixed in PyMongo 4.18.2. Percent-decoding was moved into split_hosts and now applies only to Unix domain socket paths, identified by an unescaped .sock suffix before decoding, and only after splitting on ,.

Workarounds

Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.

Details

The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where unquote_plus was applied to the whole host section in _validate_uri and, later, _parse_srv, before the string was split on , and :.

Database specific 
{
    "cwe_ids":  [
        "CWE-177"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-05T23:47:07Z",
    "nvd_published_at":  "2026-09-24T19:17:20Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / pymongo

Package

Name
pymongo
View open source insights on deps.dev
Purl
pkg:pypi/pymongo

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.5.0
Fixed
4.18.2

Affected versions

3.*
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.9.0
3.10.0
3.10.1
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.1
3.12.2
3.12.3
3.13.0
4.*
4.0
4.0.1
4.0.2
4.1.0
4.1.1
4.2.0
4.3.2
4.3.3
4.4.0b0
4.4.0
4.4.1
4.5.0
4.6.0
4.6.1
4.6.2
4.6.3
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0b0
4.8.0
4.9
4.9.1
4.9.2
4.10.0
4.10.1
4.11
4.11.1
4.11.2
4.11.3
4.12.0
4.12.1
4.13.0.dev0
4.13.0
4.13.1
4.13.2
4.14.0
4.14.1
4.15.0
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.16.0.dev0
4.16.0
4.17.0
4.18.0
4.18.1

Database specific

last_known_affected_version_range 
"<= 4.18.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vp6j-j7w5-5xjj/GHSA-vp6j-j7w5-5xjj.json"