The MongoDB C# driver contains a flaw in its document‑replacement write path that skips the element‑name/shape validation normally applied to update operations. As a result, a user who supplies loosely‑typed or untrusted data as the replacement value can embed MongoDB query operators, which are forwarded to the server and interpreted as update logic, not data. This grants the application the ability to execute arbitrary update commands under its own credentials.

This vulnerability affects the MongoDB C# Driver, including versions released prior to the fix. The reference package version 3.11.1 is known to contain the impacted code path. All installations of the driver that allow replacement of document data without strong typing are potentially exposed. Applications that map documents using strongly typed classes are not affected.

The CVSS score of 5.3 indicates a moderate impact, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are documented. The likely attack vector is through an application’s own logic where it accepts untrusted input and passes it as a replacement value; an attacker who can influence that input can inject update logic and modify or delete data. The exploitation requires only application‑level access and does not rely on network weaknesses, making the risk dependent on how the driver is used.