{"schema":"threatline.record/2","record":{"id":"CVE-2026-88029","aliases":["GHSA-8fvv-fgr5-f8ch","PYSEC-2026-4294"],"summary":"pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods","details":"### Impact\n\nWhen reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match.\n\n### Patches\nPatch available in pymongo >= 4.18.1\n\n### Workarounds\nEnsure your existing workflow _only_ supports exact matching on the GridFS API.","categories":["Databases"],"product":"pymongo","vendor":"MongoDB","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8fvv-fgr5-f8ch","source_modified_at":"2026-10-05T23:27:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pymongo"},"range":"<= 4.18.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88029","source_modified_at":"2026-09-10T18:25:06.926Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Python Driver","vendor":"MongoDB","versions":[{"status":"affected","version":"1.6.0","lessThan":"4.18.1","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8fvv-fgr5-f8ch","source_modified_at":"2026-10-15T14:55:35.220353794Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"pymongo","ecosystem":"PyPI","purl":"pkg:pypi/pymongo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.1"}]}],"versions":["0.1.1pre","0.1.2pre","0.10","0.10.1","0.10.2","0.10.3","0.11","0.11.1","0.11.2","0.11.3","0.12","0.13","0.14","0.14.1","0.14.2","0.15","0.15.1","0.15.2","0.16","0.1pre","0.2pre","0.3.1pre","0.3pre","0.4pre","0.5.1pre","0.5.2pre","0.5.3pre","0.5pre","0.6","0.7","0.7.1","0.7.2","0.8","0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","1.0","1.1","1.1.1","1.1.2","1.10","1.10.1","1.11","1.2"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8fvv-fgr5-f8ch","source_modified_at":"2026-10-05T23:27:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pymongo"},"version":"4.18.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88029","source_modified_at":"2026-09-10T18:25:06.926Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Python Driver","ecosystem":null},"version":"4.18.1","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8fvv-fgr5-f8ch","source_modified_at":"2026-10-15T14:55:35.220353794Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"pymongo","ecosystem":"PyPI","purl":"pkg:pypi/pymongo"},"version":"4.18.1"}],"cvss":6.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00265,"percentile":0.17424,"score_date":"2026-10-23"},"published_at":"2026-09-10T17:56:25.421Z","modified_at":"2026-10-15T14:55:35.220353794Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-8fvv-fgr5-f8ch","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T23:27:14Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-88029","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-10T18:25:06.926Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-8fvv-fgr5-f8ch","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-15T14:55:35.220353794Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88029","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-8fvv-fgr5-f8ch","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88029","source":"GitHub Advisory Database"},{"url":"https://github.com/mongodb/mongo-python-driver/pull/3046","source":"GitHub Advisory Database"},{"url":"https://github.com/mongodb/mongo-python-driver/commit/3ef1c607859589a0086446ad6f557791a2813681","source":"GitHub Advisory Database"},{"url":"https://github.com/mongodb/mongo-python-driver/commit/fa676586ba4b399168a4d1d41c30dc2166cc44fd","source":"GitHub Advisory Database"},{"url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.1","source":"GitHub Advisory Database"},{"url":"https://jira.mongodb.org/browse/PYTHON-5992","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-8fvv-fgr5-f8ch","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://jira.mongodb.org/browse/PYTHON-5994"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-10T18:24:57.437403Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:55:35.220353794Z","content_hash":"88e92b3205822a8ccf9e8b766aa258f970fe00d65e7428f25f1a9f0d70114c92"}}