Skip to content
Heist/ feed
High

Shell script injection via server-supplied database name in Open MongoDB shell

Type: advisorySource: Official CVE List1 source record

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

Announced Source revision 1
Original source ↗

CVE-2026-96750

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-96750

Compass

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "MongoDB",
    "product": "Compass",
    "versions": [
      {
        "status": "affected",
        "version": "1.44.0",
        "lessThan": "1.49.12",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-96750

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#1993 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement