CVE-2026-81527

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81527
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81527.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81527
Published
2026-08-27T18:32:28Z
Modified
2026-10-01T03:47:39Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
Details

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.

Database specific 
{
    "cna_assigner": "mongodb",
    "cwe_ids": [
        "CWE-943"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81527.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.14.0"
                },
                {
                    "fixed": "3.11.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo-csharp-driver

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo-csharp-driver
Events
Introduced
569905ff5e778c38ea19d9d0392496a83e1704ed
Fixed
682ad0faea0a03648ee2c4ca8f48c3b04f4c9ab8
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:mongodb:c\\#_driver:*:*:*:*:*:mongodb:*:*",
    "extracted_events": [
        {
            "introduced": "2.10.0"
        },
        {
            "fixed": "3.11.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v2.*
v2.10.0
v2.11.0
v2.11.0-beta1
v2.11.0-beta2
v2.12.0
v2.12.0-beta1
v2.13.0
v2.13.0-beta1
v2.14.0
v2.14.0-beta1
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.23.1
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v3.*
v3.0.0
v3.1.0
v3.10.0
v3.11.0
v3.2.0
v3.2.1
v3.3.0
v3.4.0
v3.5.0
v3.6.0
v3.7.0
v3.7.1
v3.8.0
v3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81527.json"