The MongoDB Entity Framework Core provider fails to neutralize special characters when inserting caller‑supplied values into a bulk‑update expression. Because MongoDB interprets certain characters as part of its query language, user data can be evaluated as an expression, allowing an attacker to alter fields that were not intended to be modified or to move existing data into other fields. This flaw can result in unintended data corruption and loss of data integrity within affected records.

The vulnerability affects the MongoDB Entity Framework Core provider. No specific product versions are listed in the CNA data, so any deployment of this provider that includes bulk update logic may be susceptible.

The CVSS score of 2.3 indicates a low severity impact. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation knowledge. However, if an attacker can supply data that is processed by a bulk update operation, they could exploit the flaw to modify application data. The risk is primarily for data integrity rather than confidentiality or availability, and the likelihood of exploitation depends on the presence of unescaped user inputs in update logic.