CVE-2026-84967: Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Developers using the MongoDB extension for Visual Studio Code are exposed when they accept a connection target supplied by an untrusted party and then use the extension's integrated shell feature. The attacker does not need an account or privileges on the developer's machine.
What interaction is required for exploitation?
An attacker must persuade the developer to accept a user-supplied connection target and then open the extension's shell feature. Exploitation is not automatic; it requires several user actions.
Will the developer be able to verify the supplied connection string in the confirmation prompt?
No. The confirmation shown to the developer does not display the supplied connection-string text, so it cannot be relied on to identify malicious shell-special characters.