Mongodb Compass vulnerabilities

• hcl software compass Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing CVE-2026-113870 8.6 HighOctober 21, 2026
• hcl software compass Shell script injection via server-supplied database name in Open MongoDB shell CVE-2026-96750 7.3 HighSeptember 24, 2026
• mongodb compass Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow CVE-2026-14881 8.4 HighJuly 22, 2026
• hcl software compass Prototype pollution in csv parsing CVE-2026-9101 5.3 MediumMay 20, 2026
• mongodb compass, redhat enterprise linux for arm 64, enterprise linux for ibm z systems +2 more +4 more MongoDB Compass may be susceptible to local privilege escalation in Windows CVE-2025-1755 7.5 HighFebruary 27, 2025
• mongodb compass ejson shell parser in MongoDB Compass maybe bypassed CVE-2024-6376 Fix available 7.0 HighJuly 1, 2024
• mongodb compass Insufficient validation of external input in Compass may enable MITM attacks CVE-2024-3371 7.1 HighApril 24, 2024
• mongodb compass Local privilege escalation in MongoDB Compass for Windows CVE-2021-20334 4.8 MediumApril 6, 2021