CVE-2026-9101
published 2026-05-20CVE-2026-9101: Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user…
PriorityP421medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.41%
35.3th percentile
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Affected
126 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
| mongodb | compass | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hwpv-w8h7-v7qm: Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell
ghsa_unreviewed·2026-05-20
CVE-2026-9101 [MEDIUM] CWE-1321 GHSA-hwpv-w8h7-v7qm: Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
VulDB
MongoDB Compass up to 1.49.5 prototype pollution
vuldb·2026-05-20·CVSS 5.3
CVE-2026-9101 [MEDIUM] MongoDB Compass up to 1.49.5 prototype pollution
A vulnerability labeled as problematic has been found in MongoDB Compass. This vulnerability affects unknown code. Executing a manipulation can lead to improperly controlled modification of object prototype attributes.
This vulnerability is handled as CVE-2026-9101. The attack can be executed remotely. There is not any exploit available.
Red Hat
authlib: Authlib: Server-Side Request Forgery via unvalidated request URI
vendor_redhat·2026-10-22·CVSS 5.4
CVE-2026-114620 [MEDIUM] CWE-918 authlib: Authlib: Server-Side Request Forgery via unvalidated request URI
authlib: Authlib: Server-Side Request Forgery via unvalidated request URI
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-20
Published