Regular expression injection via unescaped characters in LINQ query translation
High7.1CVE-2026-88026 · Published Sep 10, 2026
### Impact Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter. ### Patches Fixed in 3.11.2. LINQ translator now escapes properly all reserved regex symbols. ### Workarounds No known workarounds. ### References [CSHARP-6177](https://jira.mongodb.org/browse/CSHARP-6177), [Fix](https://github.com/mongodb/mongo-csharp-driver/commit/b8fa151d70b956294efa37359881094a89e362bd), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-88026)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB.Driver NuGet | >= 2.14.0, < 3.11.2 | 3.11.2 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-943
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 11 | GridFS data disclosure and deletion via query-operator injection in file IDs | Medium6.1 | 1.30.10+1 more |
| Sep 10 | Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver | High8.2 | 5.11.1+1 more |
| Sep 10 | GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver | High8.3 | 5.11.1+1 more |
| Sep 10 | GridFS data disclosure and deletion via query-operator injection in file IDs | Medium6.1 | 3.11.2 |
| Sep 10 | GridFS data deletion via operator-document injection in file IDs | Medium6.1 | 1.17.10+1 more |
| Sep 10 | GridFS data disclosure and deletion via query-operator injection in file IDs | Medium6.1 | 3.9.1 |