CVE-2026-96750
High
Description
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
SeverityHigh
CVSS7.1
Exploit probability—
Product
Compass
PublishedSep 24, 2026
First seenSep 24, 2026
Weakness typeCWE-94Code injection
How to fix
Update
- MongoDB Compass1.49.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MongoDB Compass | 1.44.0 ≤ v < 1.49.12 | 1.49.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.