A flaw in the CSV parsing routine of MongoDB Compass allows an attacker to inject malicious properties into the object prototype. When a user imports a specially crafted CSV file, the polluted prototype can cause an untrusted file path to be passed to shell.openExternal, which may execute arbitrary shell commands with the user's privileges after a single click.

The vulnerability applies to MongoDB, Inc. Compass. No specific affected version information is supplied, so all versions that use the current import logic may be impacted until an update is released.

The CVSS score of 5.3 indicates moderate severity. Without an EPSS value the exact exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. Inferred attack vectors point to local exploitation via CSV import; an attacker would need to supply a malicious CSV to a user who then opens it, making the risk concentrated in environments where untrusted files are imported. Nonetheless, the potential for command execution warrants prompt mitigation.