Description
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
Published: 2026-09-24
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

MongoDB Compass uses the database name supplied by the server when it starts its embedded MongoDB shell. The server can supply a database name that contains shell code, and Compass does not escape that name. When a user with permissions to create databases on the target server opens the shell for that database, the injected code is executed by the shell within the Compass process. This allows an attacker to run arbitrary commands with the privileges of the Compass application.

Affected Systems

The vulnerability affects MongoDB Compass, specifically any installed version that allows a user to open the embedded shell from a database view before the fix released in version v1.49.12. Versions earlier than 1.49.12 are impacted; upgrades to 1.49.12 or later mitigate the issue.

Risk and Exploitability

The CVSS score of 7.3 indicates high severity. Although no EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, exploitation requires a user who can create databases on the MongoDB server and who can launch Compass. An attacker with those conditions can run arbitrary shell commands and potentially take control of the host running Compass. For environments where users have those privileges, the risk is high and should be addressed promptly.

Generated by OpenCVE AI on September 25, 2026 at 07:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MongoDB Compass to version 1.49.12 or newer to remove the unsafe database name interpolation.
  • Restrict MongoDB users from having the ability to create databases on the server, thereby removing the privilege needed to trigger the injection.
  • If the embedded shell feature is not required, disable it in Compass or avoid opening the shell from untrusted database views.

Generated by OpenCVE AI on September 25, 2026 at 07:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb compass
Vendors & Products Mongodb
Mongodb compass

Thu, 24 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
Title Shell script injection via server-supplied database name in Open MongoDB shell
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mongodb Compass
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-09-25T03:55:27.003Z

Reserved: 2026-09-23T15:45:51.994Z

Link: CVE-2026-96750

cve-icon Vulnrichment

Updated: 2026-09-24T17:09:46.312Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-24T16:17:27.610

Modified: 2026-09-25T04:17:50.150

Link: CVE-2026-96750

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T07:45:18Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')