Query filter regex injection via unescaped backslash and bracket in LINQ character-set translation (port to main branch)

XMLWordPrintableJSON

    • None
    • Dotnet Drivers
    • None
    • None
    • None
    • None
    • None
    • None

      The fix for CSHARP-6177 shipped in 3.11.2 on the v3.x branch only. The main branch still carries the vulnerable code: EscapeCharacterSet in StringExpressionToRegexFilterTranslator.cs does not escape backslash, open bracket or close bracket, so 4.0.0 would ship the same regex injection.

      Port the v3.x fix (commit b8fa151d70b956294efa37359881094a89e362bd) to main, along with its tests.

      See CSHARP-6177 for the full analysis. Released as CVE-2026-88026.

            Assignee:
            Oleksandr Poliakov
            Reporter:
            Adelin Mbida Owona
            None
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: