What is GHSA-wvx7-gr2m-7rf5?

GHSA-wvx7-gr2m-7rf5 is a security advisory published by GitHub Security Advisories with Critical severity. When compute mode is enabled on a standalone mongod instance, insufficient validation of...

Which CVE IDs does GHSA-wvx7-gr2m-7rf5 cover?

GHSA-wvx7-gr2m-7rf5 covers the following CVE IDs: CVE-2026-13072. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wvx7-gr2m-7rf5?

GHSA-wvx7-gr2m-7rf5 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-wvx7-gr2m-7rf5CriticalCVSS 8.1

When compute mode is enabled on a standalone mongod instance, insufficient validation of...

Vendor

GitHub Security Advisories

Published

July 22, 2026

Last Modified

July 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-13072 →

📋 Description

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13072
https://jira.mongodb.org/browse/SERVER-128494
https://github.com/advisories/GHSA-wvx7-gr2m-7rf5