{"id":"CVE-2026-120567","title":"EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference","summary":"The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an …","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-943"],"vendor":"MongoDB","product":"Entity Framework Core Provider","affected":["entity_framework_core_provider >= 9.1.3 <= 9.1.4","entity_framework_core_provider >= 10.0.3 <= 10.0.4"],"published":"2026-11-03","updated":"2026-11-04","sourceUpdated":"2026-11-04T16:30:53.153Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120567","references":[{"url":"https://jira.mongodb.org/browse/EF-478"}],"tags":["cve.org"],"epss":0.0015,"epssPercentile":0.04212,"ingestedAt":"2026-11-05T21:36:00.452Z","slug":"CVE-2026-120567","body":"## Overview\n\nThe MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them.\n\n## Affected\n\n- `entity_framework_core_provider >= 9.1.3 <= 9.1.4`\n- `entity_framework_core_provider >= 10.0.3 <= 10.0.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}