CVE-2026-9101Medium· 4.3▾ SunlitPrototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.5%
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
compass = 1.36.3compass = 1.36.4compass = 1.37.0compass = 1.38.0compass = 1.38.1compass = 1.38.2compass = 1.39.0compass = 1.39.1compass = 1.39.2compass = 1.39.3compass = 1.39.4compass = 1.40.0compass = 1.40.1compass = 1.40.2compass = 1.40.3compass = 1.40.4compass = 1.41.0compass = 1.42.0compass = 1.42.1compass = 1.42.2compass = 1.42.3compass = 1.42.5compass = 1.43.0compass = 1.43.1compass = 1.43.2compass = 1.43.3compass = 1.43.4compass = 1.43.5compass = 1.43.6compass = 1.44.0compass = 1.44.3compass = 1.44.4compass = 1.44.5compass = 1.44.6compass = 1.44.7compass = 1.45.0compass = 1.45.1compass = 1.45.2compass = 1.45.3compass = 1.45.4compass = 1.46.0compass = 1.46.1compass = 1.46.2compass = 1.46.3compass = 1.46.4compass = 1.46.5compass = 1.46.6compass = 1.46.7compass = 1.46.8compass = 1.46.9compass = 1.46.10compass = 1.46.11compass = 1.47.0compass = 1.47.1compass = 1.48.0compass = 1.48.1compass = 1.48.2compass = 1.49.0compass = 1.49.1compass = 1.49.2compass = 1.49.3compass = 1.49.4compass = 1.49.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115929Medium· 6.8MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
CVE-2026-113870High· 8.8Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
CVE-2026-14881High· 7.8When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form
CVE-2026-96750High· 7.1MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view
CVE-2026-114650Medium· 5.9Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
CVE-2026-114654Medium· 6.5BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards