{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mongodb-c%23-driver/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126982"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MongoDB C# Driver"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MongoDB"],"content_html":"\u003cp\u003eThe MongoDB C# Driver contains a vulnerability in its BSON serialization library where a type allow-list check can be bypassed during the deserialization of polymorphic data into loosely typed members. An unauthorized party who can provide crafted BSON/JSON data that the application subsequently deserializes can cause the application to instantiate .NET types outside of the intended allow-list. If the application contains suitable gadget types, this may lead to arbitrary code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can result in the execution of arbitrary code within the context of the application process, impacting confidentiality, integrity, and availability. No special privileges beyond the ability to provide input to the application's deserialization process are required.\u003c/p\u003e\n","date_modified":"2026-11-13T00:43:42Z","date_published":"2026-11-13T00:43:42Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mongodb-csharp-driver-bson-bypass-cve-2026-126982/","summary":"A type allow-list bypass in the MongoDB C# Driver BSON serialization library permits the instantiation of unauthorized .NET types during deserialization, potentially leading to arbitrary code execution if suitable gadget types are present.","title":"MongoDB C# Driver: BSON serialization type allow-list bypass (CVE-2026-126982)","url":"https://feed.craftedsignal.io/briefs/2026-11-mongodb-csharp-driver-bson-bypass-cve-2026-126982/"}],"language":"en","title":"CraftedSignal Threat Feed - MongoDB C# Driver","version":"https://jsonfeed.org/version/1.1"}