Data Injection Vulnerability
A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.
Advisories for Gem/Moped package
2015
A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.