{"uuid": "2606904e-eca0-4126-9ed0-0b7f85438e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96748", "type": "seen", "source": "https://gist.github.com/alon710/cf65fdaeab3dabc070aad5d3262b79fd", "content": "# CVE-2026-96748: CVE-2026-96748: Host Injection Vulnerability in PyMongo Connection String Parsing\n\n> **CVSS Score:** 8.3\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-96748\n\n## Summary\nA critical host injection vulnerability exists in PyMongo's connection string parser prior to version 4.18.2. The parser globally decodes percent-encoded characters in the host portion before splitting on delimiters, allowing attackers to inject arbitrary servers into the database client's connection pool.\n\n## TL;DR\nPyMongo's parser decoded percent-encoded characters before splitting hostnames, allowing attackers to inject rogue servers into connection strings.\n\n## Technical Details\n\n- **CWE ID**: CWE-177\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.3\n- **EPSS Score**: 0.00257 (15.78th percentile)\n- **Impact**: Host Injection / Adversary-in-the-Middle\n- **Exploit Status**: None (No public PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- PyMongo (Python Driver for MongoDB)\n- **PyMongo**: >= 0, < 4.18.2 (Fixed in: `4.18.2`)\n\n## Mitigation\n\n- Upgrade PyMongo to version 4.18.2 or later.\n- Implement rigorous regular expression validation on host input to reject any characters other than alphanumeric characters, hyphens, and periods.\n- Configure strict network egress rules to prevent connections to unknown or unauthorized external databases.\n\n**Remediation Steps:**\n1. Locate all installations of PyMongo in application dependencies (e.g., requirements.txt, Pipfile, poetry.lock).\n2. Update PyMongo version specification to >=4.18.2.\n3. Run pip install -r requirements.txt --upgrade or equivalent package manager commands to apply the update.\n4. Incorporate input sanitization routines for dynamic database connection host parameters.\n\n## References\n\n- [GitHub Security Advisory GHSA-vp6j-j7w5-5xjj](https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj)\n- [Fix Commit: Refactoring of host split and decode order](https://github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a)\n- [CVE Record for CVE-2026-96748](https://www.cve.org/CVERecord?id=CVE-2026-96748)\n- [Official PyMongo Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-96748) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T09:30:32.000000Z"}