---
id: CVE-2026-9101
title: >-
  Prototype pollution in csv parsing logic during import can lead to untrusted
  file paths (but not arguments) entering shell.openExternal after specific user
  behavior leading to "1-click" command execution.
summary: >-
  Prototype pollution in csv parsing logic during import can lead to untrusted
  file paths (but not arguments) entering shell.openExternal after specific user
  behavior leading to "1-click" command execution.
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-1321
vendor: mongodb
product: compass
affected:
  - compass = 1.36.3
  - compass = 1.36.4
  - compass = 1.37.0
  - compass = 1.38.0
  - compass = 1.38.1
  - compass = 1.38.2
  - compass = 1.39.0
  - compass = 1.39.1
  - compass = 1.39.2
  - compass = 1.39.3
  - compass = 1.39.4
  - compass = 1.40.0
  - compass = 1.40.1
  - compass = 1.40.2
  - compass = 1.40.3
  - compass = 1.40.4
  - compass = 1.41.0
  - compass = 1.42.0
  - compass = 1.42.1
  - compass = 1.42.2
  - compass = 1.42.3
  - compass = 1.42.5
  - compass = 1.43.0
  - compass = 1.43.1
  - compass = 1.43.2
  - compass = 1.43.3
  - compass = 1.43.4
  - compass = 1.43.5
  - compass = 1.43.6
  - compass = 1.44.0
  - compass = 1.44.3
  - compass = 1.44.4
  - compass = 1.44.5
  - compass = 1.44.6
  - compass = 1.44.7
  - compass = 1.45.0
  - compass = 1.45.1
  - compass = 1.45.2
  - compass = 1.45.3
  - compass = 1.45.4
  - compass = 1.46.0
  - compass = 1.46.1
  - compass = 1.46.2
  - compass = 1.46.3
  - compass = 1.46.4
  - compass = 1.46.5
  - compass = 1.46.6
  - compass = 1.46.7
  - compass = 1.46.8
  - compass = 1.46.9
  - compass = 1.46.10
  - compass = 1.46.11
  - compass = 1.47.0
  - compass = 1.47.1
  - compass = 1.48.0
  - compass = 1.48.1
  - compass = 1.48.2
  - compass = 1.49.0
  - compass = 1.49.1
  - compass = 1.49.2
  - compass = 1.49.3
  - compass = 1.49.4
  - compass = 1.49.5
published: '2026-05-20'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T17:29:21.770'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9101'
references:
  - url: 'https://jira.mongodb.org/browse/COMPASS-10657'
    label: cna@mongodb.com
tags:
  - nvd
epss: 0.00413
epssPercentile: 0.35381
ingestedAt: '2026-07-23T12:17:55.548Z'
---

## Overview

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

## Affected

- `compass = 1.36.3`
- `compass = 1.36.4`
- `compass = 1.37.0`
- `compass = 1.38.0`
- `compass = 1.38.1`
- `compass = 1.38.2`
- `compass = 1.39.0`
- `compass = 1.39.1`
- `compass = 1.39.2`
- `compass = 1.39.3`
- `compass = 1.39.4`
- `compass = 1.40.0`
- `compass = 1.40.1`
- `compass = 1.40.2`
- `compass = 1.40.3`
- `compass = 1.40.4`
- `compass = 1.41.0`
- `compass = 1.42.0`
- `compass = 1.42.1`
- `compass = 1.42.2`
- `compass = 1.42.3`
- `compass = 1.42.5`
- `compass = 1.43.0`
- `compass = 1.43.1`
- `compass = 1.43.2`
- `compass = 1.43.3`
- `compass = 1.43.4`
- `compass = 1.43.5`
- `compass = 1.43.6`
- `compass = 1.44.0`
- `compass = 1.44.3`
- `compass = 1.44.4`
- `compass = 1.44.5`
- `compass = 1.44.6`
- `compass = 1.44.7`
- `compass = 1.45.0`
- `compass = 1.45.1`
- `compass = 1.45.2`
- `compass = 1.45.3`
- `compass = 1.45.4`
- `compass = 1.46.0`
- `compass = 1.46.1`
- `compass = 1.46.2`
- `compass = 1.46.3`
- `compass = 1.46.4`
- `compass = 1.46.5`
- `compass = 1.46.6`
- `compass = 1.46.7`
- `compass = 1.46.8`
- `compass = 1.46.9`
- `compass = 1.46.10`
- `compass = 1.46.11`
- `compass = 1.47.0`
- `compass = 1.47.1`
- `compass = 1.48.0`
- `compass = 1.48.1`
- `compass = 1.48.2`
- `compass = 1.49.0`
- `compass = 1.49.1`
- `compass = 1.49.2`
- `compass = 1.49.3`
- `compass = 1.49.4`
- `compass = 1.49.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.