Advisoriesby IbisNoSQL injection in LINQ pipeline translation
Impact
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. An authenticated user of an application that incorporates untrusted values into affected queries may thereby cause unintended data to be returned or query results to be altered.
Patches
From driver version 3.11.1, application-supplied values in LINQ queries are escaped with $literal where the server would otherwise evaluate them, an explicit $eq is retained around values that would be read as query operators, and field names derived from application data that cannot be represented safely are rejected with an ExpressionNotSupportedException.
Workarounds
Never build document keys from untrusted data, and do not accept user-supplied strings starting with $ where they will be evaluated as part of an aggregation expression — projections, GroupBy keys, $expr filters. This applies to expression filters passed to UpdateMany and DeleteMany.
References
[CSHARP-6178](https://jira.mongodb.org/browse/CSHARP-6178),...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB.Driver NuGet | >= 2.14.0, < 3.11.1 | 3.11.1 |
Details and references
### Impact A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. An authenticated user of an application that incorporates untrusted values into affected queries may thereby cause unintended data to be returned or query results to be altered. ### Patches From driver version 3.11.1, application-supplied values in LINQ queries are escaped with `$literal` where the server would otherwise evaluate them, an explicit `$eq` is retained around values that would be read as query operators, and field names derived from application data that cannot be represented safely are rejected with an `ExpressionNotSupportedException`. ### Workarounds Never build document keys from untrusted data, and do not accept user-supplied strings starting with $ where they will be evaluated as part of an aggregation expression — projections, `GroupBy` keys, `$expr` filters. This applies to expression filters passed to `UpdateMany` and `DeleteMany`. ### References [CSHARP-6178](https://jira.mongodb.org/browse/CSHARP-6178), [CSHARP-6156](https://jira.mongodb.org/browse/CSHARP-6156),[CSHARP-6185](https://jira.mongodb.org/browse/CSHARP-6185), [Fix](https://github.com/mongodb/mongo-csharp-driver/commit/230d4492e62915b6aa5e788cdcc38d0ab0ebd965), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-81527)
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-943