CVE-2022-48282 Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution
A privileged user can execute arbitrary code via deserialization in C# applications using the MongoDB .NET Driver under specific non-default configurations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48282?
CVE-2022-48282 is a medium-severity unsafe deserialization vulnerability in MongoDB .NET/C# Driver, published on 21 Feb 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0
Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND * Application must be running on a Windows host using the full .NET Framework, not .NET Core AND * Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND * Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable
Weakness: CWE-502
Which versions are affected by CVE-2022-48282?
2 open source packages ship an affected version, including MongoDB.Driver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
MongoDB.Driver NuGet | All versions | 2.19.0 |
MongoDB.Driver NuGet | All versions | 2.19.0 |
Products include Mongodb C\# Driver.
How do I fix CVE-2022-48282?
Upgrade MongoDB.Driver to 2.19.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-48282 being exploited?
There is no known exploitation of CVE-2022-48282 in the wild and no public exploit code.
Other vulnerabilities in MongoDB .NET/C# Driver
- CVE-2026-88026 Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver
- CVE-2026-81529 Connection-option injection via unescaped settings in the canonical MongoDB URL builder
- CVE-2026-81527 NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
- CVE-2026-81530 KMS master key exposure via unredacted credential serialization in driver settings string
- CVE-2026-88025 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver
Sources
Also known as ECHO-1b69-da77-cf10, GHSA-7j9m-j397-g4wx.