CVE-2026-88026 (Medium) detected in mongodb.driver.3.8.0.nupkg

[mend-bolt-for-github]

CVE-2026-88026 - Medium Severity Vulnerability

Vulnerable Library - mongodb.driver.3.8.0.nupkg

Official .NET driver for MongoDB.

Library home page: https://api.nuget.org/packages/mongodb.driver.3.8.0.nupkg

Sample Path to Dependency File: /src/SharpConnector.Api/SharpConnector.Api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg,/home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg,/home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg

Dependency Hierarchy:

• ❌ mongodb.driver.3.8.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

Publish Date: 2026-09-10

URL: CVE-2026-88026

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-09-10

Fix Resolution: mongodb.driver - 3.11.2,https://github.com/mongodb/mongo-csharp-driver.git - v3.11.2,MongoDB.Driver - 3.11.2

---

Step up your Open Source Security Game with Mend here