Compass
Monthly
Code injection in MongoDB Compass lets an attacker who holds database-creation privileges on a MongoDB server interpolate unescaped shell syntax into the initial input of Compass's embedded MongoDB shell; when a victim user navigates to that database's view and explicitly opens the shell from it, the injected content is evaluated inside the Compass client process with that process's privileges. Exploitation is constrained: the attacker must be able to create databases on the connected server and name one maliciously, and the victim must perform the specific action of opening the shell for exactly that database, which is why the issue carries High attack complexity despite the 7.3 severity. Execution is confined to the Compass client process and does not reach the MongoDB server; Compass v1.49.12 is the fixed release, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
OS command injection in MongoDB Compass allows an attacker to smuggle a malicious 'browser open command' for the OIDC authentication flow into an importable connection file, a setting normally restricted to global Compass application settings and not editable through the connection form. When a victim imports the crafted connection and initiates OIDC authentication, the attacker-controlled command executes on the victim's host with the user's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 8.4 (High) reflecting full compromise of confidentiality, integrity, and availability of the local system.
Prototype pollution in MongoDB Compass's CSV import parsing logic creates a '1-click' command execution path across versions 1.36.x through 1.49.5. A crafted CSV file can pollute JavaScript object prototypes during the import workflow, causing untrusted file paths to reach Electron's shell.openExternal() API and be executed by the operating system's default handler. No public exploit code has been identified and this CVE is absent from CISA KEV, but the passive user-interaction requirement - simply importing a CSV as part of routine database work - makes targeted social engineering a credible delivery vector in data-heavy environments.
MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is. Rated high severity (CVSS 7.5). No vendor patch available.
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling.42.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Code injection in MongoDB Compass lets an attacker who holds database-creation privileges on a MongoDB server interpolate unescaped shell syntax into the initial input of Compass's embedded MongoDB shell; when a victim user navigates to that database's view and explicitly opens the shell from it, the injected content is evaluated inside the Compass client process with that process's privileges. Exploitation is constrained: the attacker must be able to create databases on the connected server and name one maliciously, and the victim must perform the specific action of opening the shell for exactly that database, which is why the issue carries High attack complexity despite the 7.3 severity. Execution is confined to the Compass client process and does not reach the MongoDB server; Compass v1.49.12 is the fixed release, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
OS command injection in MongoDB Compass allows an attacker to smuggle a malicious 'browser open command' for the OIDC authentication flow into an importable connection file, a setting normally restricted to global Compass application settings and not editable through the connection form. When a victim imports the crafted connection and initiates OIDC authentication, the attacker-controlled command executes on the victim's host with the user's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 8.4 (High) reflecting full compromise of confidentiality, integrity, and availability of the local system.
Prototype pollution in MongoDB Compass's CSV import parsing logic creates a '1-click' command execution path across versions 1.36.x through 1.49.5. A crafted CSV file can pollute JavaScript object prototypes during the import workflow, causing untrusted file paths to reach Electron's shell.openExternal() API and be executed by the operating system's default handler. No public exploit code has been identified and this CVE is absent from CISA KEV, but the passive user-interaction requirement - simply importing a CSV as part of routine database work - makes targeted social engineering a credible delivery vector in data-heavy environments.
MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is. Rated high severity (CVSS 7.5). No vendor patch available.
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling.42.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.