Refine your search

9 vulnerabilities found for Compass by MongoDB

CERTFR-2026-AVI-1386
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
MongoDB libmongocrypt libmmongocrypt versions antérieures à 1.21.1
MongoDB C Driver C Driver versions 2.5.x antérieures à 2.5.7
MongoDB C Driver C Driver versions antérieures à 1.30.14
MongoDB C# Driver C# Driver versions antérieures à 3.13.0
MongoDB Compass Compass versions antérieures à 1.53.1
References
Bulletin de sécurité MongoDB CSHARP-6162 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB v1.53.1 2026-10-24 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6186 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6166 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB MONGOCRYPT-963 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6174 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6157 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6181 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6184 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6180 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6421 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6170 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6179 2026-10-22 vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6168 2026-10-22 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "libmmongocrypt versions ant\u00e9rieures \u00e0 1.21.1",
      "product": {
        "name": "libmongocrypt",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C Driver versions 2.5.x ant\u00e9rieures \u00e0 2.5.7",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C Driver versions ant\u00e9rieures \u00e0 1.30.14",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C# Driver versions ant\u00e9rieures \u00e0 3.13.0",
      "product": {
        "name": "C# Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Compass versions ant\u00e9rieures \u00e0 1.53.1",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-114645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114645"
    },
    {
      "name": "CVE-2026-114652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114652"
    },
    {
      "name": "CVE-2026-114649",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114649"
    },
    {
      "name": "CVE-2026-114646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114646"
    },
    {
      "name": "CVE-2026-114648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114648"
    },
    {
      "name": "CVE-2026-114654",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114654"
    },
    {
      "name": "CVE-2026-114653",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114653"
    },
    {
      "name": "CVE-2026-114643",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114643"
    },
    {
      "name": "CVE-2026-114647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114647"
    },
    {
      "name": "CVE-2026-114650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114650"
    },
    {
      "name": "CVE-2026-114644",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114644"
    },
    {
      "name": "CVE-2026-115929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115929"
    },
    {
      "name": "CVE-2026-114651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114651"
    },
    {
      "name": "CVE-2026-114655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114655"
    }
  ],
  "initial_release_date": "2026-10-26T00:00:00",
  "last_revision_date": "2026-10-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1386",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits MongoDB. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6162",
      "url": "https://jira.mongodb.org/browse/CSHARP-6162"
    },
    {
      "published_at": "2026-10-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB v1.53.1",
      "url": "https://github.com/mongodb-js/compass/releases/tag/v1.53.1"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6186",
      "url": "https://jira.mongodb.org/browse/CSHARP-6186"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6166",
      "url": "https://jira.mongodb.org/browse/CSHARP-6166"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOCRYPT-963",
      "url": "https://jira.mongodb.org/browse/MONGOCRYPT-963"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6174",
      "url": "https://jira.mongodb.org/browse/CSHARP-6174"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6157",
      "url": "https://jira.mongodb.org/browse/CSHARP-6157"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6181",
      "url": "https://jira.mongodb.org/browse/CSHARP-6181"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6184",
      "url": "https://jira.mongodb.org/browse/CSHARP-6184"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6180",
      "url": "https://jira.mongodb.org/browse/CSHARP-6180"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6421",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6421"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6170",
      "url": "https://jira.mongodb.org/browse/CSHARP-6170"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6179",
      "url": "https://jira.mongodb.org/browse/CSHARP-6179"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6168",
      "url": "https://jira.mongodb.org/browse/CSHARP-6168"
    }
  ]
}

CERTFR-2026-AVI-1234
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
MongoDB C Driver mongo-c-driver versions antérieures à 2.5.5
MongoDB Compass Compass versions antérieures à 1.49.12
MongoDB MongoDB MongoDB versions antérieures à 1.21.10
MongoDB C Driver mongo-c-driver versions antérieures à 1.30.12
MongoDB MongoDB-extension MongoDB-extension versions 2.2.x à 2.5.x antérieures à 2.5.3
MongoDB PyMongo pymongo versions antérieures à 4.18.2
MongoDB MongoDB MongoDB versions 2.2.x à 2.5.x antérieures à 2.5.3
MongoDB MongoDB MongoDB versions 2.x antérieures à 2.1.10
MongoDB MongoDB-extension MongoDB-extension versions 2.x antérieures à 2.1.10
MongoDB MongoDB-extension MongoDB-extension versions antérieures à 1.21.10
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "mongo-c-driver versions ant\u00e9rieures \u00e0 2.5.5",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Compass versions ant\u00e9rieures \u00e0 1.49.12",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB versions ant\u00e9rieures \u00e0 1.21.10",
      "product": {
        "name": "MongoDB",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "mongo-c-driver versions ant\u00e9rieures \u00e0 1.30.12",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB-extension versions 2.2.x \u00e0 2.5.x ant\u00e9rieures \u00e0 2.5.3",
      "product": {
        "name": "MongoDB-extension",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "pymongo versions ant\u00e9rieures \u00e0 4.18.2",
      "product": {
        "name": "PyMongo",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB versions 2.2.x \u00e0 2.5.x ant\u00e9rieures \u00e0 2.5.3",
      "product": {
        "name": "MongoDB",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB versions 2.x ant\u00e9rieures \u00e0 2.1.10",
      "product": {
        "name": "MongoDB",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB-extension versions 2.x ant\u00e9rieures \u00e0 2.1.10",
      "product": {
        "name": "MongoDB-extension",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB-extension versions ant\u00e9rieures \u00e0 1.21.10",
      "product": {
        "name": "MongoDB-extension",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-96745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96745"
    },
    {
      "name": "CVE-2026-96748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96748"
    },
    {
      "name": "CVE-2026-96747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96747"
    },
    {
      "name": "CVE-2026-96749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96749"
    },
    {
      "name": "CVE-2026-96746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96746"
    }
  ],
  "initial_release_date": "2026-09-28T00:00:00",
  "last_revision_date": "2026-09-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1234",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es, un contournement de la politique de s\u00e9curit\u00e9 et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2026-09-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-frjf-h5jg-4v46",
      "url": "https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46"
    },
    {
      "published_at": "2026-09-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-qx36-8mw2-4r3x",
      "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x"
    },
    {
      "published_at": "2026-09-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-vp6j-j7w5-5xjj",
      "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj"
    },
    {
      "published_at": "2026-09-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB 3579",
      "url": "https://github.com/mongodb/laravel-mongodb/pull/3579"
    },
    {
      "published_at": "2026-09-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB v1.49.12",
      "url": "https://github.com/mongodb-js/compass/releases/tag/v1.49.12"
    },
    {
      "published_at": "2026-09-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-cmvj-vxvq-rh2c",
      "url": "https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c"
    },
    {
      "published_at": "2026-09-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-v4x9-3549-crwv",
      "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv"
    }
  ]
}

CERTFR-2026-AVI-0922
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité, un déni de service et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
MongoDB Core Server Core Server versions 8.0.x antérieures à 8.0.28
MongoDB Compass Compass versions antérieures à 1.49.7
MongoDB Core Server Core Server versions 7.0.x antérieures à 7.0.39
MongoDB Core Server Core Server versions 8.2.x antérieures à 8.2.12
MongoDB Core Server Core Server versions 8.3.x antérieures à 8.3.7
References
Bulletin de sécurité MongoDB SERVER-128517 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-127831 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128494 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-127661 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128512 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128362 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128832 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-125872 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB v1.49.7 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128316 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128341 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-124355 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128473 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-127280 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-127737 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128584 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128433 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-127689 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128387 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-127566 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-123081 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-126247 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-128198 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-127357 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-127694 2026-07-22 vendor-advisory
Bulletin de sécurité MongoDB SERVER-129103 2026-07-22 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Core Server versions 8.0.x ant\u00e9rieures \u00e0 8.0.28",
      "product": {
        "name": "Core Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Compass versions ant\u00e9rieures \u00e0 1.49.7",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Core Server versions 7.0.x ant\u00e9rieures \u00e0 7.0.39",
      "product": {
        "name": "Core Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Core Server versions 8.2.x ant\u00e9rieures \u00e0 8.2.12",
      "product": {
        "name": "Core Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Core Server versions 8.3.x ant\u00e9rieures \u00e0 8.3.7",
      "product": {
        "name": "Core Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-13066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13066"
    },
    {
      "name": "CVE-2026-14881",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14881"
    },
    {
      "name": "CVE-2026-13064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13064"
    },
    {
      "name": "CVE-2026-13071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13071"
    },
    {
      "name": "CVE-2026-13074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13074"
    },
    {
      "name": "CVE-2026-13060",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13060"
    },
    {
      "name": "CVE-2026-13065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13065"
    },
    {
      "name": "CVE-2026-13075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13075"
    },
    {
      "name": "CVE-2026-13063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13063"
    },
    {
      "name": "CVE-2026-13077",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13077"
    },
    {
      "name": "CVE-2026-13076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13076"
    },
    {
      "name": "CVE-2026-13061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13061"
    },
    {
      "name": "CVE-2026-13058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13058"
    },
    {
      "name": "CVE-2026-13067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13067"
    },
    {
      "name": "CVE-2026-13057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13057"
    },
    {
      "name": "CVE-2026-13059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13059"
    },
    {
      "name": "CVE-2026-13056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13056"
    },
    {
      "name": "CVE-2026-13070",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13070"
    },
    {
      "name": "CVE-2026-13062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13062"
    },
    {
      "name": "CVE-2026-13072",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13072"
    },
    {
      "name": "CVE-2026-9737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9737"
    },
    {
      "name": "CVE-2026-13073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13073"
    },
    {
      "name": "CVE-2026-13078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13078"
    },
    {
      "name": "CVE-2026-13068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13068"
    },
    {
      "name": "CVE-2026-13055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13055"
    },
    {
      "name": "CVE-2026-13069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13069"
    }
  ],
  "initial_release_date": "2026-07-24T00:00:00",
  "last_revision_date": "2026-07-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0922",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9, un d\u00e9ni de service et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128517",
      "url": "https://jira.mongodb.org/browse/SERVER-128517"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127831",
      "url": "https://jira.mongodb.org/browse/SERVER-127831"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128494",
      "url": "https://jira.mongodb.org/browse/SERVER-128494"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127661",
      "url": "https://jira.mongodb.org/browse/SERVER-127661"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128512",
      "url": "https://jira.mongodb.org/browse/SERVER-128512"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128362",
      "url": "https://jira.mongodb.org/browse/SERVER-128362"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128832",
      "url": "https://jira.mongodb.org/browse/SERVER-128832"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-125872",
      "url": "https://jira.mongodb.org/browse/SERVER-125872"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB v1.49.7",
      "url": "https://github.com/mongodb-js/compass/releases/tag/v1.49.7"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128316",
      "url": "https://jira.mongodb.org/browse/SERVER-128316"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128341",
      "url": "https://jira.mongodb.org/browse/SERVER-128341"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-124355",
      "url": "https://jira.mongodb.org/browse/SERVER-124355"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128473",
      "url": "https://jira.mongodb.org/browse/SERVER-128473"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127280",
      "url": "https://jira.mongodb.org/browse/SERVER-127280"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127737",
      "url": "https://jira.mongodb.org/browse/SERVER-127737"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128584",
      "url": "https://jira.mongodb.org/browse/SERVER-128584"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128433",
      "url": "https://jira.mongodb.org/browse/SERVER-128433"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127689",
      "url": "https://jira.mongodb.org/browse/SERVER-127689"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128387",
      "url": "https://jira.mongodb.org/browse/SERVER-128387"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127566",
      "url": "https://jira.mongodb.org/browse/SERVER-127566"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123081",
      "url": "https://jira.mongodb.org/browse/SERVER-123081"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-126247",
      "url": "https://jira.mongodb.org/browse/SERVER-126247"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128198",
      "url": "https://jira.mongodb.org/browse/SERVER-128198"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127357",
      "url": "https://jira.mongodb.org/browse/SERVER-127357"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127694",
      "url": "https://jira.mongodb.org/browse/SERVER-127694"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-129103",
      "url": "https://jira.mongodb.org/browse/SERVER-129103"
    }
  ]
}

CERTFR-2025-AVI-0166
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer une élévation de privilèges et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
MongoDB Mongosh mongosh versions antérieures à 2.3.9
MongoDB Compass Compass version antérieures à 1.42.1
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "mongosh versions ant\u00e9rieures \u00e0 2.3.9",
      "product": {
        "name": "Mongosh",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Compass version ant\u00e9rieures \u00e0 1.42.1",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-1692",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1692"
    },
    {
      "name": "CVE-2025-1691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1691"
    },
    {
      "name": "CVE-2025-1756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1756"
    },
    {
      "name": "CVE-2025-1755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1755"
    },
    {
      "name": "CVE-2025-1693",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1693"
    }
  ],
  "initial_release_date": "2025-02-28T00:00:00",
  "last_revision_date": "2025-02-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0166",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-02-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2025-02-27",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOSH-2026",
      "url": "https://jira.mongodb.org/browse/MONGOSH-2026"
    },
    {
      "published_at": "2025-02-27",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOSH-2028",
      "url": "https://jira.mongodb.org/browse/MONGOSH-2028"
    },
    {
      "published_at": "2025-02-27",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOSH-2025",
      "url": "https://jira.mongodb.org/browse/MONGOSH-2025"
    },
    {
      "published_at": "2025-02-27",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB COMPASS-9058",
      "url": "https://jira.mongodb.org/browse/COMPASS-9058"
    },
    {
      "published_at": "2025-02-27",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOSH-2024",
      "url": "https://jira.mongodb.org/browse/MONGOSH-2024"
    }
  ]
}

CERTFR-2024-AVI-0537
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
MongoDB Server MongoDB Server versions 5.x antérieures à 5.0.22
MongoDB Compass MongoDB Compass versions antérieures à 1.42.2
MongoDB Server MongoDB Server versions 7.x antérieures à 7.0.3
MongoDB N/A libbson versions antérieures à 1.26.2
MongoDB Server MongoDB Server versions 6.x antérieures à 6.0.11
MongoDB Rust Driver MongoDB Rust Driver versions 2.x antérieures à 2.8.2
References
Bulletin de sécurité MongoDB COMPASS-7496 2024-07-01 vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-5622 2024-07-02 vendor-advisory
Bulletin de sécurité MongoDB SERVER-79327 2024-07-01 vendor-advisory
Bulletin de sécurité MongoDB RUST-1881 2024-07-02 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MongoDB Server versions 5.x ant\u00e9rieures \u00e0 5.0.22",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Compass versions ant\u00e9rieures \u00e0 1.42.2",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Server versions 7.x ant\u00e9rieures \u00e0 7.0.3",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "libbson versions ant\u00e9rieures \u00e0 1.26.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Server versions 6.x ant\u00e9rieures \u00e0 6.0.11",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Rust Driver versions 2.x ant\u00e9rieures \u00e0 2.8.2",
      "product": {
        "name": "Rust Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6382"
    },
    {
      "name": "CVE-2024-6376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6376"
    },
    {
      "name": "CVE-2024-6375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6375"
    },
    {
      "name": "CVE-2024-6381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6381"
    }
  ],
  "initial_release_date": "2024-07-03T00:00:00",
  "last_revision_date": "2024-07-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0537",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB COMPASS-7496",
      "url": "https://jira.mongodb.org/browse/COMPASS-7496"
    },
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-5622",
      "url": "https://jira.mongodb.org/browse/CDRIVER-5622"
    },
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-79327",
      "url": "https://jira.mongodb.org/browse/SERVER-79327"
    },
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB RUST-1881",
      "url": "https://jira.mongodb.org/browse/RUST-1881"
    }
  ]
}

CERTFR-2024-AVI-0348
Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits MongoDB. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
MongoDB Compass MongoDB Compass versions 1.35.0 à 1.40.5 antérieures à 1.42.1
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MongoDB Compass versions 1.35.0 \u00e0 1.40.5 ant\u00e9rieures \u00e0 1.42.1",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-3371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3371"
    }
  ],
  "initial_release_date": "2024-04-25T00:00:00",
  "last_revision_date": "2024-04-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0348",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-04-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eles\nproduits MongoDB\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits MongoDB",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB COMPASS-7260 du 24 avril 2024",
      "url": "https://jira.mongodb.org/browse/COMPASS-7260"
    }
  ]
}

CERTFR-2021-AVI-243
Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans MongoDB Compass. Elle permet à un attaquant de provoquer une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
MongoDB Compass MongoDB Compass versions antérieures à 1.25.0
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MongoDB Compass versions ant\u00e9rieures \u00e0 1.25.0",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-20334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-20334"
    }
  ],
  "initial_release_date": "2021-04-07T00:00:00",
  "last_revision_date": "2021-04-07T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB\u00a0Compass du 06 avril 2021",
      "url": "https://jira.mongodb.org/browse/COMPASS-4510"
    }
  ],
  "reference": "CERTFR-2021-AVI-243",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-04-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans MongoDB Compass. Elle permet \u00e0\nun attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans MongoDB Compass",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB Compass du 06 avril 2021",
      "url": null
    }
  ]
}

CVE-2026-113870 (GCVE-0-2026-113870)
Vulnerability from cvelistv5
Published
2026-10-21 18:04
Modified
2026-10-21 18:04
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.6 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-116 - Improper Encoding or Escaping of Output
Summary
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
References
Impacted products
Vendor Product Version
MongoDB Compass Version: 1.7.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Compass",
          "repo": "https://github.com/mongodb-js/compass",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.49.15",
              "status": "affected",
              "version": "1.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hamza Amirache"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Hanaa Bouhia"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "MongoDB Compass improperly escapes certain BSON values when converting a stored view\u2019s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass."
            }
          ],
          "value": "MongoDB Compass improperly escapes certain BSON values when converting a stored view\u2019s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T18:04:30.607Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://www.mongodb.com/docs/compass/release-notes/#mongodb-compass-14915"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-113870",
    "datePublished": "2026-10-21T18:04:30.607Z",
    "dateReserved": "2026-10-20T19:20:31.973Z",
    "dateUpdated": "2026-10-21T18:04:30.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96750 (GCVE-0-2026-96750)
Vulnerability from cvelistv5
Published
2026-09-24 15:51
Modified
2026-09-25 03:55
Severity ?
7.3 (High) - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.1 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
References
Impacted products
Vendor Product Version
MongoDB Compass Version: 1.44.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96750",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T03:55:27.003Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Compass",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.49.12",
              "status": "affected",
              "version": "1.44.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database\u0027s view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process\u0027s privileges. This requires the Compass user to open the shell for the affected database."
            }
          ],
          "value": "MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database\u0027s view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process\u0027s privileges. This requires the Compass user to open the shell for the affected database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:51:13.247Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb-js/compass/releases/tag/v1.49.12"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Shell script injection via server-supplied database name in Open MongoDB shell",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96750",
    "datePublished": "2026-09-24T15:51:13.247Z",
    "dateReserved": "2026-09-23T15:45:51.994Z",
    "dateUpdated": "2026-09-25T03:55:27.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}