CVE-2026-96750

Awaiting Analysis Awaiting Analysis - Queue

MongoDB Compass Shell Database Name Injection

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: MongoDB, Inc.

Description

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-96750

EUVD

EUVD-2026-86260

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	compass	From 1.44.0 (inc)
mongodb	compass	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

MongoDB Compass interpolates a database name without escaping into its embedded MongoDB shell when opened from that database's view. This allows a user with database creation privileges on a server to inject content that gets evaluated as shell input within the Compass process, potentially executing arbitrary commands with the Compass process's privileges. The attack requires the Compass user to manually open the shell for the affected database.

Detection Guidance

To detect this vulnerability, check if your MongoDB Compass version is below 1.49.12. Run the command 'compass version' in your terminal or check the application's version through its GUI. If the version is older than 1.49.12, the system is vulnerable.

Impact Analysis

If you use MongoDB Compass versions 1.44.0 or later, an attacker with database creation rights on a server you connect to could execute arbitrary commands on your system with the same privileges as your Compass application. This could lead to data theft, system compromise, or further network infiltration depending on your environment.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited, especially if sensitive data is compromised through this attack vector.

Mitigation Strategies

Update MongoDB Compass to version 1.49.12 or later to address the vulnerability. This version patches the issue affecting all prior versions starting from 1.44.0.

Hi! I’m here to help you understand CVE-2026-96750. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70