CVE-2026-9101: MongoDB, Inc. Compass, инжекция

Описание

Оригинално описание

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

Засегнати продукти

• MongoDB, Inc. Compass: 1.36.3; 1.36.4; 1.37.0; 1.38.0; 1.38.1; 1.38.2; 1.39.0; 1.39.1; 1.39.2; 1.39.3; 1.39.4; 1.40.0; 1.40.1; 1.40.2; 1.40.3; 1.40.4; 1.41.0; 1.42.0; 1.42.1; 1.42.2; 1.42.3; 1.42.5; 1.43.0; 1.43.1; 1.43.2; 1.43.3; 1.43.4; 1.43.5; 1.43.6; 1.44.0; 1.44.3; 1.44.4; 1.44.5; 1.44.6; 1.44.7; 1.45.0; 1.45.1; 1.45.2; 1.45.3; 1.45.4; 1.46.0; 1.46.1; 1.46.2; 1.46.3; 1.46.4; 1.46.5; 1.46.6; 1.46.7; 1.46.8; 1.46.9; 1.46.10; 1.46.11; 1.47.0; 1.47.1; 1.48.0; 1.48.1; 1.48.2; 1.49.0; 1.49.1; 1.49.2; 1.49.3; 1.49.4; 1.49.5

Вид слабост

• CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

История

Други уязвимости в MongoDB, Inc. Compass

• 7.6CVE-2026-115929

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-9101
• https://nvd.nist.gov/vuln/detail/CVE-2026-9101
• https://jira.mongodb.org/browse/COMPASS-10657