As a client program assembles a query in MongoDB, it builds a BSON object, not a string. Thus, traditional SQL injection attacks are not a problem. However, MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server. To check, run the following command from the MongoDB shell: > db.col.find({ $where: "return true;"} ) If the response does not return an error, this is a finding. If javascript has been correctly disabled, the correct error would indicate that the javascript global engine has been disabled. For example: MongoServerError: no globalScriptEngine in $where parsing}