Vulnerability details
CVE-2026-96750
MongoDB Compass
Shell script injection via server-supplied database name in Open MongoDB shell
CVSS 4.0
7.3High
Official description
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.3High | 4.0 | CVEProject cvelistV5 (CNA) (mongodb) | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.1High | 3.1 | CVEProject cvelistV5 (CNA) (mongodb) | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| MongoDB | Compass | 1.44.0 ≤ v < 1.49.12 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-24
- Last updated
- 2026-09-25
- State
- Published
- Assigner (CNA)
- mongodb
Exploit prediction (EPSS)
0.23%
Probability of exploitation in 30 days
13.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')