MongoDB Entity Framework Core Provider vulnerabilities

The MongoDB Entity Framework Core provider does not neutralize special elements when placing a caller-supplied value into a bulk update expressed as a database query. A value supplied as plain data may be interpreted by the database as expression syntax, causing unintended modification of fields or relocation of data into other fields of the same record.

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. This may lead to protected fields being stored unencrypted.

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.