Vulnerability · Published Nov 3, 2026 · Assigned by mongodb
CVE-2026-120567EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference
Medium 5.4
In plain English
A medium-severity security flaw in Entity Framework Core Provider from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Entity Framework Core Provider | 9.1.3 – through 9.1.410.0.3 – through 10.0.4 |
Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N