What’s Vulnerable › Products

MongoDB Compass vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your MongoDB Compass version is affected

Latest MongoDB Compass vulnerabilities

• CVE-2026-115929 — MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs (CVSS 6.8)
• CVE-2026-113870 — Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing (CVSS 8.8)
• CVE-2026-96750 — Shell script injection via server-supplied database name in Open MongoDB shell (CVSS 7.1)
• CVE-2026-14881 — Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow (CVSS 7.8)
• CVE-2026-9101 — Prototype pollution in csv parsing (CVSS 4.3)
• CVE-2025-1755 — MongoDB Compass may be susceptible to local privilege escalation in Windows (CVSS 7.8)
• CVE-2024-6376 — ejson shell parser in MongoDB Compass maybe bypassed (CVSS 9.8)
• CVE-2024-3371 — Insufficient validation of external input in Compass may enable MITM attacks (CVSS 6.8)
• CVE-2021-20334 — Local privilege escalation in MongoDB Compass for Windows (CVSS 7.8)