Go Driver
Monthly
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.