---
id: CVE-2026-88026
title: >-
  Regular expression injection via unescaped characters in LINQ query
  translation in MongoDB C# Driver
summary: >-
  Improper neutralization of regular-expression metacharacters in the LINQ query
  translation component of the MongoDB C# Driver can cause a caller-supplied
  character sequence to alter a regular-expression predicate generated by an
  affected…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-943
vendor: MongoDB
product: C# Driver
affected:
  - c_driver >= 2.14.0 <= 3.11.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T18:23:15.544067Z'
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T18:24:21.520Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-88026'
references:
  - url: 'https://jira.mongodb.org/browse/CSHARP-6177'
tags:
  - cve.org
epss: 0.00371
epssPercentile: 0.28342
ingestedAt: '2026-09-11T16:45:48.027Z'
---

## Overview

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

## Affected

- `c_driver >= 2.14.0 <= 3.11.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.