PyMongo versions prior to 0.11.2_4 improperly percent-decoded the entire host section of MongoDB connection strings before splitting hosts, allowing percent-encoded delimiters (%2C for comma, %3A for colon) to inject additional attacker-controlled hosts. This could cause the client to connect to malicious servers, potentially exposing credentials or routing operations to attacker hosts. The issue is fixed in PyMongo 0.11.2_4 by restricting percent-decoding to Unix domain socket paths only after splitting hosts. Applications should avoid interpolating untrusted input into the host portion of connection strings or validate such input carefully.