CVE-2026-114647

The MongoDB C# Driver is vulnerable to a NoSQL operator injection because the FindOneAndReplace operation fails to reject replacement documents with top-level field names starting with a dollar sign ($) . If an application constructs such a document using user-supplied field names , an attacker c...