CVE-2024-6376: MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass'…

PriorityP352critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.42%

33.9th percentile

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

Affected

3 ranges

Vendor	Product	Version range	Fixed in
mongodb-js	connection-form	>= 0 < 1.20.1	1.20.1
mongodb	compass	< 1.42.2	1.42.2
mongodb_inc	mongodb_compass	< 1.42.2	1.42.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.