Description Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
A prototype pollution vulnerability has been identified in MongoDB Compass within the CSV parsing logic during import. This issue can allow untrusted file paths, but not arguments, to be passed into the 'shell.openExternal' function. Following certain user actions, this could lead to '1-click' command execution.
Users can update to MongoDB Compass version 1.49.6 to address this vulnerability.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 23, 2026 Exploitation: NoneAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration CWE-ID CWE Name Source CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') [email protected]
Affected Products Product Versions mongodb compass 1.36.3
1.36.4
1.37.0
1.38.0
1.38.1
1.38.2
1.39.0
1.39.1
1.39.2
1.39.3
1.39.4
1.40.0
1.40.1
1.40.2
1.40.3
1.40.4
1.41.0
1.42.0
1.42.1
1.42.2
1.42.3
1.42.5
1.43.0
1.43.1
1.43.2
1.43.3
1.43.4
1.43.5
1.43.6
1.44.0
1.44.3
1.44.4
1.44.5
1.44.6
1.44.7
1.45.0
1.45.1
1.45.2
1.45.3
1.45.4
1.46.0
1.46.1
1.46.2
1.46.3
1.46.4
1.46.5
1.46.6
1.46.7
1.46.8
1.46.9
1.46.10
1.46.11
1.47.0
1.47.1
1.48.0
1.48.1
1.48.2
1.49.0
1.49.1
1.49.2
1.49.3
1.49.4
1.49.5
Viewing 5 of 63 versions. View all CPE cpe:2.3:a:mongodb:compass:1.36.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.36.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.41.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.42.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.42.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.42.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.42.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.43.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.43.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.43.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.43.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.43.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.43.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.43.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.44.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.44.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.44.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.44.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.44.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.44.7:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.45.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.45.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.45.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.45.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.45.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.7:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.8:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.9:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.10:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.46.11:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.47.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.47.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.48.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.48.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.48.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.49.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.49.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.49.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.49.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.49.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:compass:1.49.5:*:*:*:*:*:*:* Remediation No remediation found in references.
Change History 5 change records found show changes