STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

DISA Rule

SV-279366r1179512_rule

Vulnerability Number

V-279366

Group Title

SRG-APP-000251-DB-000391

Rule Version

MD8X-00-005600

Severity

CAT II

CCI(s)

• CCI-001310 - Checks the validity of organization-defined information inputs to the system.

Weight

10

Fix Recommendation

Disable the "javascriptEnabled" option.

Edit the MongoDB configuration file (default location /etc/mongod.conf) to include the following:

security:
javascriptEnabled: false

Check Contents

MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

If the following parameter is not present or not set as show below in the MongoDB configuration file (default location /etc/mongod.conf), this is a finding.

security:
javascriptEnabled: false

Vulnerability Number

V-279366

Documentable

False

Rule Version

MD8X-00-005600

Severity Override Guidance

MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

If the following parameter is not present or not set as show below in the MongoDB configuration file (default location /etc/mongod.conf), this is a finding.

security:
javascriptEnabled: false

Check Content Reference

M

Target Key

5728