Mongodb For Vs Code
Monthly
Command injection in the MongoDB extension for Visual Studio Code allows a remote attacker, via social engineering, to inject arbitrary shell characters into a terminal command composed by the extension when a developer opens its integrated shell feature against an attacker-controlled connection target. The extension fails to neutralize special characters from user-supplied MongoDB connection strings before embedding them in the command line, and the confirmation dialog shown to the developer does not render the injected payload, preventing visual detection. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the multi-step social-engineering requirement is the primary barrier to exploitation.
Command injection in the MongoDB extension for Visual Studio Code allows a remote attacker, via social engineering, to inject arbitrary shell characters into a terminal command composed by the extension when a developer opens its integrated shell feature against an attacker-controlled connection target. The extension fails to neutralize special characters from user-supplied MongoDB connection strings before embedding them in the command line, and the confirmation dialog shown to the developer does not render the injected payload, preventing visual detection. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the multi-step social-engineering requirement is the primary barrier to exploitation.