The MongoDB C# Driver permits replacement documents whose top‑level field names begin with a dollar sign during a FindOneAndReplace operation. If an attacker controls those field names, the driver interprets the $‑prefixed names as update operators and applies them to the document that matches the provided filter. This causes the application to unintentionally modify the matched document’s contents, which can lead to data integrity violations. The flaw is a form of NoSQL operator injection (CWE‑943).

The vulnerability affects the MongoDB C# Driver produced by MongoDB. No specific affected driver versions are listed in the CNA data; however, any release prior to the defensive changes referenced in the official GitHub release for v3.13.0 is potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, but the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Based on the description, the likely attack vector is an application that accepts user‑provided field names and constructs a replacement document for FindOneAndReplace; an attacker can supply a replacement document that contains $‑operator field names to influence the server’s update behavior.