Description
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MongoDB | Compass | 1.36.3, 1.36.4, 1.37.0, 1.38.0, 1.38.1, 1.38.2, 1.39.0, 1.39.1, 1.39.2, 1.39.3, 1.39.4, 1.40.0, 1.40.1, 1.40.2, 1.40.3, 1.40.4, 1.41.0, 1.42.0, 1.42.1, 1.42.2, 1.42.3, 1.42.5, 1.43.0, 1.43.1, 1.43.2, 1.43.3, 1.43.4, 1.43.5, 1.43.6, 1.44.0, 1.44.3, 1.44.4, 1.44.5, 1.44.6, 1.44.7, 1.45.0, 1.45.1, 1.4… | — |
Advisories 1
- WID-SEC-2026-1617 MongoDB Compass: Schwachstelle ermöglicht Manipulation von Dateien und potenziell Codeausführung BSI CERT-Bund (WID) · May 20, 2026
References
- https://jira.mongodb.org/browse/COMPASS-10657 issue-tracking