CVE-2026-81527 — NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter transla…
Published: 2026-08-27 · CVSS: 6.9 · CVSS 4.0
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7