Arbitrary Code Execution Vulnerability in MongoDB Compass Software by MongoDB

CVE-2026-113870

What is CVE-2026-113870?

MongoDB Compass contains a vulnerability where specific BSON values are not properly escaped when transforming a stored view’s aggregation pipeline into an editable format. This issue arises when a user connects to a MongoDB deployment with a specially crafted view. Upon opening this view for editing, these improperly handled values can trigger the execution of arbitrary code, operating under the permissions of the user running the MongoDB Compass application, leading to potential unauthorized actions within the environment.

References