EUVD-2026-67211
GHSA-qvhj-5652-cjrg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable injection with no auth or interaction required; impact limited to partial data disclosure and query result alteration, scope unchanged.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C
Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.
AnalysisAI
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses the MongoDB C# Driver's LINQ-to-aggregation or query filter translation layer, AND that application-supplied (i.e., user-controlled) values are embedded into the affected LINQ query constructs without independent sanitization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) signals that exploitation requires no authentication, no special configuration, and no user interaction - a low-friction attack for any application that exposes user input paths into affected LINQ queries. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submitting a search or filter request to a .NET web application discovers that the application passes user-supplied search terms directly through a LINQ-to-MongoDB aggregation query. By embedding MongoDB query operators or expression syntax within their input, the attacker alters the query's filter logic - for example, causing a membership or ownership filter to be bypassed - and receives records belonging to other users. … |
| Remediation | Upgrade the MongoDB.Driver NuGet package to version 3.11.1 or later, available at https://www.nuget.org/packages/MongoDB.Driver/3.11.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabli
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rate
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation,
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged atta
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a co
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vu
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today