Regular expression injection via unescaped characters in LINQ query translation

Impact

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

Patches

Fixed in 3.11.2. LINQ translator now escapes properly all reserved regex symbols.

Workarounds

No known workarounds.

References

[CSHARP-6177](https://jira.mongodb.org/browse/CSHARP-6177), [Fix](https://github.com/mongodb/mongo-csharp-driver/commit/b8fa151d70b956294efa37359881094a89e362bd), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-88026)