{"id":"CVE-2026-9101","title":"Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution.","summary":"Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution.","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-1321"],"vendor":"mongodb","product":"compass","affected":["compass = 1.36.3","compass = 1.36.4","compass = 1.37.0","compass = 1.38.0","compass = 1.38.1","compass = 1.38.2","compass = 1.39.0","compass = 1.39.1","compass = 1.39.2","compass = 1.39.3","compass = 1.39.4","compass = 1.40.0","compass = 1.40.1","compass = 1.40.2","compass = 1.40.3","compass = 1.40.4","compass = 1.41.0","compass = 1.42.0","compass = 1.42.1","compass = 1.42.2","compass = 1.42.3","compass = 1.42.5","compass = 1.43.0","compass = 1.43.1","compass = 1.43.2","compass = 1.43.3","compass = 1.43.4","compass = 1.43.5","compass = 1.43.6","compass = 1.44.0","compass = 1.44.3","compass = 1.44.4","compass = 1.44.5","compass = 1.44.6","compass = 1.44.7","compass = 1.45.0","compass = 1.45.1","compass = 1.45.2","compass = 1.45.3","compass = 1.45.4","compass = 1.46.0","compass = 1.46.1","compass = 1.46.2","compass = 1.46.3","compass = 1.46.4","compass = 1.46.5","compass = 1.46.6","compass = 1.46.7","compass = 1.46.8","compass = 1.46.9","compass = 1.46.10","compass = 1.46.11","compass = 1.47.0","compass = 1.47.1","compass = 1.48.0","compass = 1.48.1","compass = 1.48.2","compass = 1.49.0","compass = 1.49.1","compass = 1.49.2","compass = 1.49.3","compass = 1.49.4","compass = 1.49.5"],"published":"2026-05-20","updated":"2026-09-24","sourceUpdated":"2026-09-24T17:29:21.770","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9101","references":[{"url":"https://jira.mongodb.org/browse/COMPASS-10657","label":"cna@mongodb.com"}],"tags":["nvd"],"epss":0.00413,"epssPercentile":0.35381,"ingestedAt":"2026-07-23T12:17:55.548Z","slug":"CVE-2026-9101","body":"## Overview\n\nPrototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution.\n\n## Affected\n\n- `compass = 1.36.3`\n- `compass = 1.36.4`\n- `compass = 1.37.0`\n- `compass = 1.38.0`\n- `compass = 1.38.1`\n- `compass = 1.38.2`\n- `compass = 1.39.0`\n- `compass = 1.39.1`\n- `compass = 1.39.2`\n- `compass = 1.39.3`\n- `compass = 1.39.4`\n- `compass = 1.40.0`\n- `compass = 1.40.1`\n- `compass = 1.40.2`\n- `compass = 1.40.3`\n- `compass = 1.40.4`\n- `compass = 1.41.0`\n- `compass = 1.42.0`\n- `compass = 1.42.1`\n- `compass = 1.42.2`\n- `compass = 1.42.3`\n- `compass = 1.42.5`\n- `compass = 1.43.0`\n- `compass = 1.43.1`\n- `compass = 1.43.2`\n- `compass = 1.43.3`\n- `compass = 1.43.4`\n- `compass = 1.43.5`\n- `compass = 1.43.6`\n- `compass = 1.44.0`\n- `compass = 1.44.3`\n- `compass = 1.44.4`\n- `compass = 1.44.5`\n- `compass = 1.44.6`\n- `compass = 1.44.7`\n- `compass = 1.45.0`\n- `compass = 1.45.1`\n- `compass = 1.45.2`\n- `compass = 1.45.3`\n- `compass = 1.45.4`\n- `compass = 1.46.0`\n- `compass = 1.46.1`\n- `compass = 1.46.2`\n- `compass = 1.46.3`\n- `compass = 1.46.4`\n- `compass = 1.46.5`\n- `compass = 1.46.6`\n- `compass = 1.46.7`\n- `compass = 1.46.8`\n- `compass = 1.46.9`\n- `compass = 1.46.10`\n- `compass = 1.46.11`\n- `compass = 1.47.0`\n- `compass = 1.47.1`\n- `compass = 1.48.0`\n- `compass = 1.48.1`\n- `compass = 1.48.2`\n- `compass = 1.49.0`\n- `compass = 1.49.1`\n- `compass = 1.49.2`\n- `compass = 1.49.3`\n- `compass = 1.49.4`\n- `compass = 1.49.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}