All vulnerabilities
CVE-2026-96750

Compass: Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB CompassDatabases
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.49.12Fixed versionCVE List
Published24 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

Text from CVE List

Affected versions 1

  • Compassaffected: 1.44.0 before 1.49.12CVE List

References 1