CVE-2026-126982

{
  "etk_id": "ETK-2026-4336",
  "cve_id": "CVE-2026-126982",
  "display_id": "CVE-2026-126982",
  "ghsa_id": "GHSA-vjj2-chwg-8r8c",
  "euvd_id": "EUVD-2026-124807",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Type allow-list bypass in MongoDB C# Driver BSON deserialization",
  "summary": "The MongoDB C# Driver BSON serialization library can bypass type restrictions when polymorphic BSON or JSON is deserialized into loosely typed members. An attacker able to plant data later processed by the application may cause unintended .NET types to be instantiated; applications containing a suitable gadget type may be exposed to code execution.",
  "mitigation": "Upgrade C# Driver to 3.14.0 or later.",
  "vendor": "MongoDB",
  "product": "C# Driver",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.2.0, < 3.14.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.14.0"
      ],
      "package_name": "C# Driver",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.16924945,
  "t0_at": "2026-11-13T00:00:12.446000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T00:00:12.446000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T00:00:12.446000+00:00",
      "url": "https://github.com/advisories/GHSA-vjj2-chwg-8r8c"
    }
  }
}