CVE-2026-114396
High · 7.1CVSS
7.1
EPSS
—
Published
Oct 21, 2026
CISA due date
—
The record
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118645 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter… CWE-943
- CVE-2026-118641 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData… CWE-943
- CVE-2026-118581 A BSON encoding component of the MongoDB Java Driver does not verify that an externally… CWE-943
- CVE-2026-55369 Waline is a comment system with backend support. CWE-943
- CVE-2026-116801 Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning… CWE-943
- CVE-2026-57193 Asterisk is an open source private branch exchange and telephony toolkit. CWE-943
- CVE-2026-55465 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-943
- CVE-2026-55444 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-943