CVE-2026-96750
published 2026-09-24CVE-2026-96750: MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that…
PriorityP338high7.1CVSS 3.1
AVNACHPRLUIRSUCHIHAH
EPSS
0.21%
10.2th percentile
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | compass | >= 1.44.0 < 1.49.12 | 1.49.12 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB Compass up to 1.49.11 os command injection
vuldb·2026-09-24·CVSS 7.1
CVE-2026-96750 [HIGH] MongoDB Compass up to 1.49.11 os command injection
A vulnerability labeled as problematic has been found in MongoDB Compass up to 1.49.11. The affected element is an unknown function. The manipulation results in os command injection.
This vulnerability is cataloged as CVE-2026-96750. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view.
ghsa_unreviewed·2026-09-24
CVE-2026-96750 [HIGH] CWE-94 MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view.
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-24
Published