Injection Vulnerability in MongoDB Compass by MongoDB Inc.

CVE-2026-96750

What is CVE-2026-96750?

MongoDB Compass exhibits an injection vulnerability that allows unescaped database names to be interpolated into the initial input of its embedded MongoDB shell. This occurs when users interact with the shell from the database's view. If a user has privileges to create databases on the server, they may inadvertently evaluate content as shell input within the Compass context. Such exposure can cause serious security risks, especially if sensitive data is mishandled or delivered through the compromised shell process.

References