EUVD-2026-67212
GHSA-3jfm-hm2c-wrqh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects that exploitation requires the target application to use loosely-typed replacement patterns; PR:L because application-layer authenticated access is needed to reach the vulnerable code path.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A MongoDB C
driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.
AnalysisAI
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged attackers to inject MongoDB query-language operators into database operations. The driver omits the element-name and shape validation applied by other write paths, so untrusted loosely-typed input (BsonDocument, Dictionary, dynamic) is forwarded to the MongoDB server unfiltered, enabling attacker-controlled data to be interpreted as update logic under the application's own database credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete conditions must all be met: (1) The application uses MongoDB.Driver (C# NuGet) in a version prior to 3.11.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N captures real but bounded risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with authenticated access to an application API endpoint that accepts JSON document input crafts a replacement payload containing MongoDB update operators - for example, substituting a legitimate replacement body with {"$set": {"role": "administrator"}} or {"$unset": {"auditLog": ""}}. Because the C# driver forwards the replacement to MongoDB without neutralizing the '$'-prefixed operator keys, the server executes the injected logic under the application's database credentials, allowing unauthorized modification or disclosure of database contents. … |
| Remediation | Upgrade MongoDB.Driver to version 3.11.1 or later via NuGet (https://www.nuget.org/packages/MongoDB.Driver/3.11.1), which reintroduces element-name and shape validation for the document-replacement code path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabli
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rate
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation,
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a co
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vu
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today