MongoDB Compass
6 CVEs affecting MongoDB Compass. Latest disclosed: 2026-09-24. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1755 | High | 7.5 | 2025-02-27 | MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with ele… |
CVE-2026-96750 | High | 7.1 | 2026-09-24 | MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that dat… |
CVE-2024-3371 | High | 7.1 | 2024-04-24 | MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including… |
CVE-2024-6376 | High | 7.0 | 2024-07-01 | MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connectio… |
CVE-2021-20334 | Medium | 4.8 | 2021-04-06 | A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the use… |
CVE-2026-9101 | Medium | 4.3 | 2026-05-20 | Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user beh… |