STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must check the validity of all data inputs except those specifically identified by the organization.

DISA Rule

SV-279365r1179467_rule

Vulnerability Number

V-279365

Group Title

SRG-APP-000251-DB-000160

Rule Version

MD8X-00-005500

Severity

CAT II

CCI(s)

• CCI-001310 - Checks the validity of organization-defined information inputs to the system.

Weight

10

Fix Recommendation

Disable the javascriptEnabled option in the MongoDB configuration file (default location /etc/mongod.conf) to include the following:

security:
javascriptEnabled: false

If document validation is needed, it must be configured according to the documentation page at:
https://www.mongodb.com/docs/v8.0/core/schema-validation/

Check Contents

As a client program assembles a query in MongoDB, it builds a BSON object, not a string. Thus, traditional SQL injection attacks are not a problem. However, MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

To check, run the following command from the MongoDB shell:

> db.col.find({ $where: "return true;"} )

If the response does not return an error, this is a finding.

If javascript has been correctly disabled, the correct error would indicate that the javascript global engine has been disabled. For example:

MongoServerError: no globalScriptEngine in $where parsing}

Vulnerability Number

V-279365

Documentable

False

Rule Version

MD8X-00-005500

Severity Override Guidance

As a client program assembles a query in MongoDB, it builds a BSON object, not a string. Thus, traditional SQL injection attacks are not a problem. However, MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

To check, run the following command from the MongoDB shell:

> db.col.find({ $where: "return true;"} )

If the response does not return an error, this is a finding.

If javascript has been correctly disabled, the correct error would indicate that the javascript global engine has been disabled. For example:

MongoServerError: no globalScriptEngine in $where parsing}

Check Content Reference

M

Target Key

5728