Description
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MongoDB | Compass | 1.7.0 – < 1.49.15 | 1.49.15 |
Advisories 1
- WID-SEC-2026-4110 MongoDB Compass: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 21, 2026