CVE-2026-120567lowCWE-943

CVE-2026-120567: falha de baixa gravidade em MongoDB Entity Framework Core Provider

EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar MongoDB Entity Framework Core Provider

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3epss 0.1%
The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · Entity Framework Core Provider