STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB must check the validity of all data inputs except those specifically identified by the organization.

DISA Rule

SV-265929r1028804_rule

Vulnerability Number

V-265929

Group Title

SRG-APP-000251-DB-000160

Rule Version

MD7X-00-005700

Severity

CAT II

CCI(s)

• CCI-001310 - Checks the validity of organization-defined information inputs to the system.

Weight

10

Fix Recommendation

Disable the javascriptEnabled option in the MongoDB configuration file (default location: /etc/mongod.conf) to include the following:

security:
javascriptEnabled: false

If document validation is needed, it should be configured according to the documentation page at: https://www.mongodb.com/docs/v7.0/core/schema-validation/.

Check Contents

As a client program assembles a query in MongoDB, it builds a BSON object, not a string. Thus traditional SQL injection attacks are not a problem. However, MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

To check, run the following command from the MongoDB shell:

> db.col.find({ $where: "return true;"} )

If the response does not return an error, this is a finding.

If javascript has been correctly disabled, the correct error would indicate that the javascript global engine has been disabled. For example:

MongoServerError: no globalScriptEngine in $where parsing}

Vulnerability Number

V-265929

Documentable

False

Rule Version

MD7X-00-005700

Severity Override Guidance

As a client program assembles a query in MongoDB, it builds a BSON object, not a string. Thus traditional SQL injection attacks are not a problem. However, MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

To check, run the following command from the MongoDB shell:

> db.col.find({ $where: "return true;"} )

If the response does not return an error, this is a finding.

If javascript has been correctly disabled, the correct error would indicate that the javascript global engine has been disabled. For example:

MongoServerError: no globalScriptEngine in $where parsing}

Check Content Reference

M

Target Key

5637