CVE-2026-84967

Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code (affected versions not specified)

Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value into a command line for an integrated terminal. This allows an unauthenticated remote unauthorized user to inject arbitrary characters into the command line if they can persuade a developer to accept a user-supplied connection target and open the extension's shell feature. The process requires specific user actions, and the confirmation prompt shown to the developer does not display the supplied text.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.