A flaw was found in pymongo. The driver improperly decodes percent-encoded characters in connection strings before separating host entries on delimiters. If an application incorporates untrusted hostnames into its connection strings, a remote attacker can inject arbitrary servers into the database client configuration. As a result, the application may connect to an attacker-controlled server, leading to data tampering and information disclosure.