CVE-2026-9101

Published: May 20, 2026Modified: Sep 24, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

Affected (63)

Products: Mongodb: Compass

Mongodb

1 product

Compass

Configuration A

63 vulnerable

Vulnerable Software	Affected Versions
Mongodb Compass	Version 1.36.3
Mongodb Compass	Version 1.36.4
Mongodb Compass	Version 1.37.0
Mongodb Compass	Version 1.38.0
Mongodb Compass	Version 1.38.1
Mongodb Compass	Version 1.38.2
Mongodb Compass	Version 1.39.0
Mongodb Compass	Version 1.39.1
Mongodb Compass	Version 1.39.2
Mongodb Compass	Version 1.39.3
Mongodb Compass	Version 1.39.4
Mongodb Compass	Version 1.40.0
Mongodb Compass	Version 1.40.1
Mongodb Compass	Version 1.40.2
Mongodb Compass	Version 1.40.3
Mongodb Compass	Version 1.40.4
Mongodb Compass	Version 1.41.0
Mongodb Compass	Version 1.42.0
Mongodb Compass	Version 1.42.1
Mongodb Compass	Version 1.42.2
Mongodb Compass	Version 1.42.3
Mongodb Compass	Version 1.42.5
Mongodb Compass	Version 1.43.0
Mongodb Compass	Version 1.43.1
Mongodb Compass	Version 1.43.2
Mongodb Compass	Version 1.43.3
Mongodb Compass	Version 1.43.4
Mongodb Compass	Version 1.43.5
Mongodb Compass	Version 1.43.6
Mongodb Compass	Version 1.44.0
Mongodb Compass	Version 1.44.3
Mongodb Compass	Version 1.44.4
Mongodb Compass	Version 1.44.5
Mongodb Compass	Version 1.44.6
Mongodb Compass	Version 1.44.7
Mongodb Compass	Version 1.45.0
Mongodb Compass	Version 1.45.1
Mongodb Compass	Version 1.45.2
Mongodb Compass	Version 1.45.3
Mongodb Compass	Version 1.45.4
Mongodb Compass	Version 1.46.0
Mongodb Compass	Version 1.46.10
Mongodb Compass	Version 1.46.11
Mongodb Compass	Version 1.46.1
Mongodb Compass	Version 1.46.2
Mongodb Compass	Version 1.46.3
Mongodb Compass	Version 1.46.4
Mongodb Compass	Version 1.46.5
Mongodb Compass	Version 1.46.6
Mongodb Compass	Version 1.46.7
Mongodb Compass	Version 1.46.8
Mongodb Compass	Version 1.46.9
Mongodb Compass	Version 1.47.0
Mongodb Compass	Version 1.47.1
Mongodb Compass	Version 1.48.0
Mongodb Compass	Version 1.48.1
Mongodb Compass	Version 1.48.2
Mongodb Compass	Version 1.49.0
Mongodb Compass	Version 1.49.1
Mongodb Compass	Version 1.49.2
Mongodb Compass	Version 1.49.3
Mongodb Compass	Version 1.49.4
Mongodb Compass	Version 1.49.5

Related CWEs

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (1)

https://jira.mongodb.org/browse/COMPASS-10657

Source: cna@mongodb.com

Vendor Advisory

Timeline

No history available yet.