{"id":"CVE-2022-48282","aliases":["GHSA-7j9m-j397-g4wx"],"url":"https://o3.security/vulnerability/CVE-2022-48282","summary":"Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution","details":"Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0\n\nFollowing configuration must be true for the vulnerability to be applicable:  *  Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND\n  *  Application must be running on a Windows host using the full .NET Framework, not .NET Core AND\n  *  Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND\n  *  Malicious attacker must have unrestricted insert access to target database to add a _t discriminator.\"Following configuration must be true for the vulnerability to be applicable\n\n\n\n","published":"2023-02-21T18:35:11.643Z","modified":"2026-08-12T03:51:17.182928225Z","cvss":{"score":6.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"MongoDB.Driver","fixedVersion":"2.19.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/mongodb/mongo-csharp-driver/releases/tag/v2.19.0"},{"type":"WEB","url":"https://jira.mongodb.org/browse/CSHARP-4475"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48282.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48282"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230324-0003/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:17.182928225Z"}}