Executive brief
The MongoDB C# Driver's LINQ query translator fails to properly escape special characters when building regular expressions for database filters. An authenticated attacker who can control text input to a database filter can inject arbitrary regex patterns, causing the application to return or modify records that should have been excluded by the original filter. This could expose customer data or allow unauthorized record modifications.
Technical details
The vulnerability is an improper neutralization of regex metacharacters (CWE-1025) in the LINQ-to-filter translation layer. The EscapeCharacterSet function in StringExpressionToRegexFilterTranslator.cs escapes only space, '.', '-', '^', and tab characters, leaving backslash (\) and bracket (]) unescaped when building character classes like [^{set}]. An attacker who controls runtime values captured by the LINQ expression (via IndexOfAny, string indexing, or Trim operations) can inject a ']' to close the character class early, causing subsequent attacker-supplied characters to be interpreted as raw regex metacharacters. The unescaped pattern is then spliced directly into the $regex filter sent to MongoDB. Authentication is required, and the attacker must influence input to a filter that uses affected string methods; exploitation is reliable and deterministic once such a pattern exists in the application.
Affected products
- MongoDB C# Driver before 3.11.2
Timeline
- 2026-09-10: disclosed
- 2026: patched: Fix version 3.11.2