Description

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T20:18:51.197Z",
  "pubdate": "2026-08-27T20:18:51.197Z",
  "executiveSummary": "A NoSQL/expression injection vulnerability has been identified within the LINQ-to-aggregation query translation layer of the MongoDB C# Driver.\nThe vulnerability affects both aggregation expression and query filter translation modules, allowing for the potential manipulation of database queries through improperly sanitized user-supplied input.\nBy injecting malicious query logic into data fields, an unauthorized actor may be able to bypass data filtering, retrieve sensitive information, or modify the intended logic of database operations.\nThis vulnerability stems from a failure to correctly escape special elements when translating C# LINQ expressions into the MongoDB query language (MQL).\nThe risk implication is significant as it allows attackers to influence backend query structure without direct access to the database engine, solely relying on the application's ability to incorporate untrusted input into LINQ constructs.\nSuccessful exploitation requires the attacker to have the ability to supply input that is processed by the vulnerable driver translation layer, effectively turning data inputs into functional query operators.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient sanitization mechanism within the LINQ-to-aggregation translation component of the MongoDB C# Driver.\nWhen a developer utilizes LINQ to build MongoDB queries, the driver is responsible for mapping C# expressions to the equivalent MongoDB aggregation framework operators or filter documents.\nDuring this translation process, user-provided values are often embedded directly into the generated query structure. The vulnerability exists because the driver fails to distinguish between literal data values and MongoDB query operators (e.g., $gt, $ne, $where) contained within these inputs.\nIf an application uses LINQ patterns that accept dynamic input—such as filtering or searching based on user-provided strings—an attacker can supply a specially crafted JSON object or operator-prefixed string. The driver, failing to escape these elements, interprets them as native query directives rather than literal data, thereby altering the query's AST (Abstract Syntax Tree).\nThe attack flow proceeds as follows: First, the attacker identifies an application entry point that passes user input into a LINQ query filter or aggregation builder. Second, the attacker crafts a payload utilizing MongoDB-specific query operators that manipulate the logical flow of the query (e.g., injecting {'$ne': null} to bypass equality checks). Third, the MongoDB C# Driver translates this malicious input into the final MQL command without stripping the operators. Finally, the MongoDB server executes the modified command, leading to unauthorized data exposure or operational modification.\nThis vulnerability is present in the translation layer, specifically impacting the logic that handles the conversion of LINQ expressions to the MongoDB aggregation framework and standard query filters. The impact is significant as it grants the attacker control over the logical outcome of database queries, effectively bypassing intended application constraints.\nBecause the vulnerability occurs at the driver level, it is agnostic to the specific database version, relying instead on the interpretation of the resulting MQL by the MongoDB server. No specific authentication is inherently required to leverage the flaw if the vulnerable code path is reachable via public-facing application interfaces."
}