---
id: "CVE-2026-114396"
kind: "vulnerability"
aliases: ["CVE-2026-114396"]
title: "Trudesk: search parameter injects code into MongoDB queries"
severity: "high"
cvss: 7.1
epss: 0.00477
exploited: false
status: "open"
category: "package"
products: [{"name": "trudesk", "fixed": [], "affected": "<= 1.2.11", "ecosystem": "github"}]
ecosystems: []
tags: ["auth-required", "helpdesk", "mongodb", "node.js", "package", "self-hosted", "trudesk"]
not_affected_if: ["auth-required", "managed-hosting", "search-endpoint-blocked"]
published_at: "2026-10-21T13:18:30+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:02:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114396", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114396", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T04:02:52+00:00"}]
---

# Trudesk: search parameter injects code into MongoDB queries

Trudesk through 1.2.11 lets a logged-in user inject JavaScript into a MongoDB $where clause through the search parameter of the ticket search API. An attacker can use this to hang the database for denial of service or read full ticket documents, including internal notes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:trudesk affected <= 1.2.11 fixed ?

## How to check

- Check the Trudesk version in package.json or the Settings page: 1.2.11 or earlier is affected.
- Check whether GET /api/v1/tickets/search is reachable by any logged-in user (default 'user' role has tickets:view). Vulnerable code is src/models/ticket.js lines 1184-1215 in v1.2.11.
- Look in the access logs for search values containing a closing regex delimiter, quotes, or JavaScript.

## Fix

No patched version published as of 2026-10-25. Latest release is 1.2.11, which is affected. Restrict access to GET /api/v1/tickets/search (for example block it at a reverse proxy) and limit accounts until the vendor ships a fix. Check github.com/polonel/trudesk for a release newer than 1.2.11.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114396
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114396
- 2026-10-25T04:02:52+00:00 analyst — No vendor advisory or fixed release found: polonel/trudesk releases list v1.2.11 as latest, finder report (HackMD, Viettel Post leediay153, reported to vendor 2026-09-20) and VulnCheck advisory say <=1.2.11. Related issue #750 was closed as stale with no fix. Nothing marked verified; the HackMD N-2 section was truncated so the exact payload was not read.

## Documents

- [advisory] VulnCheck: Trudesk through 1.2.11 MongoDB $where Injection via tickets search API https://www.vulncheck.com/advisories/trudesk-through-1.2.11-mongodb-where-injection-via-tickets-search-api
- [mentions] polonel/trudesk releases (latest listed v1.2.11) https://github.com/polonel/trudesk/releases
- [poc] Trudesk 1.2.11 Security Report (leediay153), finding N-2 https://hackmd.io/@leediay/multiple-vuln-trudesk-1211

## From the sources

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_