Threats tagged 'ghsa-vjj2-chwg-8r8c'

CVE-2026-126982 is a high-severity vulnerability in the BSON serialization library of the MongoDB C# Driver. It allows bypassing a type allow-list restriction during deserialization of polymorphic data into loosely typed members. An attacker who can supply or plant BSON/JSON data that the application deserializes can cause instantiation of unauthorized .NET types with attacker-controlled values. This can lead to arbitrary code execution if a suitable gadget type exists in the application, resulting in loss of confidentiality, integrity, and availability. No special privileges beyond the ability to influence input data are required.