CVE-2026-120567
MediumCVSS 5.4Summary
The MongoDB Entity Framework Core provider does not neutralize special elements when placing a caller-supplied value into a bulk update expressed as a database query. A value supplied as plain data may be interpreted by the database as expression syntax, causing unintended modification of fields or relocation of data into other fields of the same record.
Risk Assessment
An attacker may cause unintended modification or relocation of data in records updated by the application.
Recommendation
Update the MongoDB Entity Framework Core provider to a patched version and validate input before using it in bulk updates.
Other vulnerabilities in MongoDB Entity Framework Core provider
See all- CVE-2026-92757Medium
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. This may lead to protected fields being stored unencrypted.
- CVE-2026-92756Medium
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Original NVD description (English source)
The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal application input may causeunintended modification of fields in the records the application is updating, and may cause data already held in those records to be relocated into other fields of the same record.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS