All vulnerabilities
CVE-2026-114648GHSA-2xqr-fxmx-2cmf

C# Driver: NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

MongoDB C# DriverDatabases
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.13.0Fixed versionCVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 3.13.0C# DriverCVE List
  • 3.13.0MongoDB.Driver, nugetGitHubdotnet add package MongoDB.Driver --version 3.13.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.

Text from CVE List

Affected versions 2

  • C# Driveraffected: 2.14.0 before 3.13.0CVE List
  • MongoDB.Driver, nuget >= 2.14.0, < 3.13.0GitHub

References 3