Executive brief
MongoDB's C# driver translates LINQ queries into aggregation pipelines. When application code uses GroupBy with user-supplied data (such as grouping by a customer-provided field name), that data is not properly escaped before being sent to the database. An attacker can inject special MongoDB operators (like field-path prefixes or aggregation functions) through the data values, causing the database to return unintended fields, corrupt grouping results, or execute arbitrary JavaScript on servers with scripting enabled.
Technical details
This is a NoSQL injection vulnerability in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver. The root cause is that the PartialEvaluator folds parameter-independent GroupBy key selectors—which may capture user-supplied values from closures, dictionaries, or arrays—into ConstantExpressions. These constants are serialized to BSON and wrapped in AstConstantExpression, then passed directly to the $group stage without proper escaping. AstConstantExpression.Render() only wraps top-level dollar-prefixed strings in $literal, leaving nested dollar-prefixed values and keys in documents/arrays unquoted. When embedded into the $group command, the MongoDB server interprets these as live aggregation expressions (field paths like $anyField, operators like $cond, or $function calls), allowing attackers to disclose arbitrary fields or execute malicious code. The vulnerability affects LINQ GroupBy constructs where attacker-controlled strings are part of the grouping key or accumulator values. A patch is available in version 3.11.1.
Affected products
- MongoDB C# Driver before 3.11.1
Timeline
- 2026-08-27: disclosed
- 2026: patched: Fixed in version 3.11.1