A data‑query‑logic neutralization weakness in the update‑statement construction component of the MongoDB C# Driver allows application supplied values to be interpreted as query or update logic instead of literal data. This flaw enables an attacker who controls input that reaches the driver’s update builder to alter or delete content in the database, granting unauthorized integrity impact on application data. The attacker does not require elevated privileges; ordinary read‑write application access suffices. No confidentiality or availability loss is reported.

The vulnerability affects the MongoDB C# Driver used in .NET applications. No specific driver versions are listed as affected, but references point to the need for an update; upgrading to the latest release (e.g., 3.13.0 or later) is recommended.

The flaw carries a CVSS score of 7.1, indicating moderate to high risk. EPSS is not available, and the issue is not listed in CISA KEV. Attackers with routine application‑level access can inject harmful update expressions via the builder, potentially modifying or deleting data. Because the exploitation path is tied to ordinary user input, the likelihood of abuse remains significant where input validation is weak.