STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

DISA Rule

SV-265930r1028805_rule

Vulnerability Number

V-265930

Group Title

SRG-APP-000251-DB-000391

Rule Version

MD7X-00-005800

Severity

CAT II

CCI(s)

• CCI-001310 - Checks the validity of organization-defined information inputs to the system.

Weight

10

Fix Recommendation

Disable the "javascriptEnabled" option.

Edit the MongoDB configuration file (default location: /etc/mongod.conf) to include the following:

security:
javascriptEnabled: false

Check Contents

MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

If the following parameter is not present or not set as show below in the MongoDB configuration file (default location: /etc/mongod.conf), this is a finding.

security:
javascriptEnabled: false

Vulnerability Number

V-265930

Documentable

False

Rule Version

MD7X-00-005800

Severity Override Guidance

MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

If the following parameter is not present or not set as show below in the MongoDB configuration file (default location: /etc/mongod.conf), this is a finding.

security:
javascriptEnabled: false

Check Content Reference

M

Target Key

5637