MongoDB Compass fails to properly escape certain BSON values when converting a stored view’s aggregation pipeline into editable source. The vulnerability is an instance of improper encoding (CWE-116) that allows an attacker to inject malicious JavaScript code. When a user opens a specially crafted view for editing, the payload is executed with the privileges of the user running Compass, granting the attacker arbitrary code execution on the client machine.

All installations of MongoDB Compass that connect to a MongoDB deployment containing a maliciously constructed view are impacted. The vulnerability is present until the Compass software is updated to a version that includes the proper escaping fix.

The CVSS score of 8.6 indicates a high severity. Although an EPSS score is not available, the lack of a published KEV listing suggests no widespread exploitation has been observed yet. The attack vector is local: the user must run Compass and open the vulnerable view, implying that the threat is confined to the end‑user’s environment and does not require external network access.