CVE-2026-126982

{
  "etk_id": "ETK-2026-4336",
  "cve_id": "CVE-2026-126982",
  "display_id": "CVE-2026-126982",
  "ghsa_id": "GHSA-vjj2-chwg-8r8c",
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Type allow-list bypass in MongoDB C# Driver BSON deserialization",
  "summary": "MongoDB C# Driver applications that deserialize attacker-supplied or attacker-planted BSON or JSON into loosely typed polymorphic members are affected. An attacker may cause instantiation of .NET types outside the intended allow-list with attacker-controlled values, potentially leading to code execution where a suitable gadget type is present. The attacker must be able to introduce data that the application later deserializes.",
  "mitigation": "Do not deserialize untrusted BSON or JSON into loosely typed polymorphic members, and restrict who can introduce data consumed by these deserialization paths. Review affected applications for an applicable vendor update and deploy it when available.",
  "vendor": "MongoDB",
  "product": "C# Driver",
  "affected": [],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-11-13T00:00:12.446000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T00:00:12.446000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T00:00:12.446000+00:00",
      "url": "https://github.com/advisories/GHSA-vjj2-chwg-8r8c"
    }
  }
}