Skip to content
OpenAdvisories

Product · MongoDB

Entity Framework Core Provider

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2026-120567

    EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference

    The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, …

    MongoDB Entity Framework Core Provider