This vulnerability (CWE-943) in the MongoDB C# Driver's LINQ query translation component allows improper neutralization of regular-expression metacharacters. Specifically, a caller-supplied character sequence can alter the regular-expression predicate generated by the application. This can lead to unintended data disclosure by returning records beyond the scope of the original query filter. The issue affects versions >=2.14.0 and <=3.11.1 of the driver. No known exploits are reported in the wild, and no vendor patch or advisory details are provided in the input data.

An authenticated user who can influence the input to the LINQ query translation may cause the application to return additional records beyond those intended, potentially exposing sensitive data. This could lead to unauthorized data disclosure within applications using affected versions of the MongoDB C# Driver.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should carefully validate and sanitize user inputs that influence LINQ queries to mitigate the risk of query manipulation.