CVE-2026-114396 in Trudesk
Summary
by MITRE • 10/21/2026
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
Trudesk, an open-source IT help desk application built on Node.js and MongoDB, suffered from a critical server-side JavaScript injection vulnerability in versions through 1.2.11. This flaw resided within the search functionality exposed via the GET /api/v1/tickets/search endpoint. The root cause of this issue was improper sanitization or validation of user-supplied input before it was incorporated into MongoDB query operations, specifically those utilizing the $where clause. In MongoDB, the $where operator allows for JavaScript expressions to be executed against documents in a collection, providing powerful but dangerous flexibility if not carefully controlled. By injecting malicious code through the search parameter, an authenticated attacker could manipulate these queries to execute arbitrary server-side JavaScript within the context of the database engine.
The technical exploitation of this vulnerability involved crafting specific payloads that closed existing regular expressions or query structures and injected new JavaScript commands. Because the application did sufficiently validate the input before passing it to MongoDB, attackers were able to bypass standard filtering mechanisms. This lack of strict type checking and output encoding allowed for code injection directly into the database layer. The ability to execute arbitrary JavaScript on the server side represents a severe breach in security boundaries, as it effectively grants the attacker control over data retrieval logic and potentially broader system interactions depending on the privileges held by the MongoDB service account.
The operational impact of this vulnerability is twofold, encompassing both confidentiality breaches and availability disruptions. On one hand, an authenticated user could exploit the injection to leak sensitive information from ticket documents. This includes not only standard ticket details but also internal notes that are typically hidden from end-users or lower-privileged accounts. Such data leakage can expose proprietary business processes, customer personal identifiable information, and other confidential organizational secrets. On the other hand, attackers could engineer payloads designed to cause infinite loops within the MongoDB engine by forcing it to evaluate complex expressions repeatedly without termination conditions. This results in a denial of service condition where database resources are exhausted, leading to application unresponsiveness or crashes for all users relying on the Trudesk platform.
From a classification perspective, this vulnerability aligns with CWE-95, known as Improper Neutralization of Directives in Dynamically Evaluated Code, commonly referred to as Server-Side JavaScript Injection. It also relates closely to CWE-78, which covers Operating System Command Injection, although the execution vector here is specifically within a database query context rather than direct shell commands. In terms of adversary tactics, this exploitation technique maps to MITRE ATT&CK techniques involving data exfiltration and resource hijacking for denial of service purposes. The attack requires authentication, placing it in categories that target authenticated users with lower privileges who can still cause significant harm through input manipulation.
Mitigation strategies primarily involve upgrading the Trudesk installation to version 1.2.12 or later, where this vulnerability has been patched by implementing stricter input validation and avoiding the use of $where clauses for user-controlled search parameters. If immediate patching is not feasible, administrators should implement web application firewall rules that detect and block suspicious patterns in query strings associated with MongoDB injection attempts. Additionally, restricting database permissions to follow the principle of least privilege can limit the potential damage if an injection occurs by preventing the database service from performing unintended administrative actions or accessing unauthorized collections. Regular security audits focusing on dynamic code evaluation practices are also recommended to prevent similar vulnerabilities in future development cycles.