CVE-2026-113870: Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
Published Oct 21, 2026
·Updated
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
Affected Software
1 affected component
MongoDB Compass
Event History
Oct 21, 2026
CVE Published
via MITRE·06:04 PM
Data Sourced
via MITRE·06:04 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users are exposed to this issue?
Users running MongoDB Compass are exposed when they connect to a MongoDB deployment containing a specially crafted stored view and open that view for editing.
2
What interaction is required for code execution to occur?
The user must open the crafted stored view for editing in Compass. The resulting code executes with the privileges of the user running Compass.