The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal application input may causeunintended modification of fields in the records the application is updating, and may cause data already held in those records to be relocated into other fields of the same record.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://jira.mongodb.org/browse/EF-478 |
|
History
Tue, 03 Nov 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal application input may causeunintended modification of fields in the records the application is updating, and may cause data already held in those records to be relocated into other fields of the same record. | |
| Title | ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions | |
| Weaknesses | CWE-943 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: mongodb
Published:
Updated: 2026-11-03T19:36:46.042Z
Reserved: 2026-11-02T16:36:20.651Z
Link: CVE-2026-120567
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-03T20:18:12.137
Modified: 2026-11-03T20:18:12.137
Link: CVE-2026-120567
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses