Advisories · Technology
MongoDB Compass.
Every CVE that names MongoDB Compass among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
- MongoDB Compass
- CWE-116
- CVSS 7.3 High
Shell script injection via server-supplied database name in Open MongoDB shell
- MongoDB Compass
- Code injection
- CVSS 8.4 High
Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow
- MongoDB Compass
- Command injection