An attacker can force the MongoDB Visual Studio Code extension to insert unsanitized characters from a user‑supplied connection string into a shell command that the extension runs in the integrated terminal. The resulting shell expansion allows the attacker to run arbitrary commands on the developer’s machine, compromising integrity and confidentiality of local data. This is a classic command injection flaw (CWE‑78).

The affected product is the MongoDB for VS Code extension. All versions of the extension that contain the vulnerable component are impacted, but no specific version numbers are listed in the CVE report. The vulnerability applies only when the extension’s Launch MongoDB Shell terminal is used with any connection string supplied by an external user.

The CVSS score of 5.1 indicates moderate complexity, but the need for user interaction and confirmation reduces the likelihood of exploitation. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalogue. Because the attacker must persuade a developer to accept a malicious connection target and open the shell, the risk depends on social engineering success rather than technical exploitation alone.