CVE Feed

    Dashboard / CVE / CVE-2026-113870

    CVE-2026-113870

    MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.

    Published:Oct 21, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 21, 2026
    EPSS Score:0.00238
    CVSS Score:8.8

    Affected Products

    Vendor
    Mongodb
    Product
    Compass

    Exploits

    https://github.com/emirwtz/CVE-2026-113870https://github.com/mehmet-emir-eroglu/CVE-2026-113870

    Related CVEs

    CVE-2026-115929 (CVSS 7.6) — MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. Thi…
    CVE-2026-96750 (CVSS 7.3) — MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoD…
    CVE-2026-14881 (CVSS 8.4) — When importing connections in Compass it is possible to override some connection options that are otherwise ca…
    CVE-2026-9101 (CVSS 5.3) — Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) en…
    CVE-2025-1755 (CVSS 7.5) — MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling…
    CVE-2024-6376 (CVSS 7) — MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the …
    CVE-2024-3371 (CVSS 7.1) — MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may …
    CVE-2021-20334 (CVSS 4.8) — A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High