PYSEC-2026-4294
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/pymongo/PYSEC-2026-4294.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-4294
- Aliases
- Published
- 2026-10-15T10:22:44Z
- Modified
- 2026-10-15T14:45:14Z
- Severity
-
- 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
- Details
-
Impact
When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match.
Patches
Patch available in pymongo >= 4.18.1
Workarounds
Ensure your existing workflow only supports exact matching on the GridFS API.
- References
-
- https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-8fvv-fgr5-f8ch
- https://nvd.nist.gov/vuln/detail/CVE-2026-88029
- https://github.com/mongodb/mongo-python-driver/pull/3046
- https://github.com/mongodb/mongo-python-driver/commit/3ef1c607859589a0086446ad6f557791a2813681
- https://github.com/mongodb/mongo-python-driver/commit/fa676586ba4b399168a4d1d41c30dc2166cc44fd
- https://github.com/mongodb/mongo-python-driver
- https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.1
- https://jira.mongodb.org/browse/PYTHON-5992
- https://pypi.org/project/pymongo
- https://github.com/advisories/GHSA-8fvv-fgr5-f8ch
Affected packages
PyPI / pymongo
Package
- Name
- pymongo
- View open source insights on deps.dev
- Purl
- pkg:pypi/pymongo
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed4.18.1
Affected versions
0.*
0.1pre
0.1.1pre
0.1.2pre
0.2pre
0.3pre
0.3.1pre
0.4pre
0.5pre
0.5.1pre
0.5.2pre
0.5.3pre
0.6
0.7
0.7.1
0.7.2
0.8
0.8.1
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.10
0.10.1
0.10.2
0.10.3
0.11
0.11.1
0.11.2
0.11.3
0.12
0.13
0.14
0.14.1
0.14.2
0.15
0.15.1
0.15.2
0.16
1.*
1.0
1.1
1.1.1
1.1.2
1.2
1.2.1
1.3
1.4
1.5
1.5.1
1.5.2
1.6
1.7
1.8
1.8.1
1.9
1.10
1.10.1
1.11
2.*
2.0
2.0.1
2.1
2.1.1
2.2
2.2.1
2.3
2.4
2.4.1
2.4.2
2.5
2.5.1
2.5.2
2.6
2.6.1
2.6.2
2.6.3
2.7
2.7.1
2.7.2
2.8
2.8.1
2.9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
3.*
3.0
3.0.1
3.0.2
3.0.3
3.1
3.1.1
3.2
3.2.1
3.2.2
3.3.0
3.3.1
3.4.0
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.9.0
3.10.0
3.10.1
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.1
3.12.2
3.12.3
3.13.0
4.*
4.0
4.0.1
4.0.2
4.1.0
4.1.1
4.2.0
4.3.2
4.3.3
4.4.0b0
4.4.0
4.4.1
4.5.0
4.6.0
4.6.1
4.6.2
4.6.3
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0b0
4.8.0
4.9
4.9.1
4.9.2
4.10.0
4.10.1
4.11
4.11.1
4.11.2
4.11.3
4.12.0
4.12.1
4.13.0.dev0
4.13.0
4.13.1
4.13.2
4.14.0
4.14.1
4.15.0
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.16.0.dev0
4.16.0
4.17.0
4.18.0