CVE-2026-96750

Name of the Vulnerable Software and Affected Versions MongoDB Compass (affected versions not specified)

Description MongoDB Compass fails to escape the database name when interpolating it into the initial input of the embedded MongoDB shell. This occurs when a user opens the shell from a specific database view. An attacker with permissions to create databases on the server can craft a database name that is evaluated as shell input within the Compass process, executing commands with the privileges of that process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.