Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-88026

Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver

Description

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB C# Driver

Default version status: unaffected

  • 2.14.0 to ≤ 3.11.1affected

References