CVE-2026-96750: Shell script injection via server-supplied database name in Open MongoDB shell
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs privileges to create databases on a MongoDB server that the Compass user connects to. Exploitation also depends on the Compass user opening the embedded shell from the affected database's view.
What access does successful exploitation provide?
Attacker-controlled content can be evaluated as shell input within the Compass process. The resulting actions run with the privileges of that Compass process.
Is user interaction required?
Yes. The Compass user must open the embedded MongoDB shell for the database whose name contains the attacker-controlled content.
What version information is available for remediation?
The provided release reference points to MongoDB Compass v1.49.12. No affected-version range or explicit fixed-version statement is provided.