CVE Feed

    Dashboard / CVE / CVE-2026-96750

    CVE-2026-96750

    MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

    Published:Sep 24, 2026
    Last Modified:Sep 24, 2026
    EPS:Sep 24, 2026
    EPSS Score:
    CVSS Score:7.1

    Affected Products

    Vendor
    Mongodb
    Product
    Compass

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-115929 (CVSS 7.6) — MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. Thi…
    CVE-2026-113870 (CVSS 8.6) — MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline in…
    CVE-2026-14881 (CVSS 8.4) — When importing connections in Compass it is possible to override some connection options that are otherwise ca…
    CVE-2026-9101 (CVSS 5.3) — Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) en…
    CVE-2025-1755 (CVSS 7.5) — MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling…
    CVE-2024-6376 (CVSS 7) — MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the …
    CVE-2024-3371 (CVSS 7.1) — MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may …
    CVE-2021-20334 (CVSS 4.8) — A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High