CVE-2026-967507.3HighCWE-94
CVE-2026-96750: Shell script injection via server-supplied database name in Open MongoDB shell
MongoDB · Compass
Vendor fix available · Affected: MongoDB Compass · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.2%probability of exploitation in the next 30 days
13th percentile
050100
Higher than 13% of scored CVEs
7.3HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 25 Sep.
- MongoDB Fixes Seven Driver Flaws, Including Rogue Server AttacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.