Improper neutralization of regular‑expression metacharacters in the LINQ query translation logic of the MongoDB C# Driver allows an attacker to inject characters that alter the generated regular‑expression predicate. The attacker can cause the application to return database records that were not intended by the original filter, thereby revealing confidential data to an unauthorized party. This flaw stems from CWE‑943, where a malicious input is incorrectly treated as code.

The vulnerability affects the MongoDB C# Driver. No specific driver versions are listed in the data; the flaw exists in all incident versions that use the affected LINQ translation component.

The CVSS score of 7.1 indicates high severity. EPSS data is unavailable, but the vulnerability is not currently listed in CISA KEV. An attacker must be authenticated with the ability to influence query input, so the exploitation scope is limited to accounts that can interact with the driver. Once exploited, the attacker can read data beyond the intended filter set, compromising confidentiality.