CVE-2026-113870highCWE-116

CVE-2026-113870: high-severity vulnerability in MongoDB Compass

Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

Published · Updated

Follow this CVE+ Monitor MongoDB Compass

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.2%
from disclosure to weapon6 days
Published on NVDOct 21
1st PoC+6d
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
MongoDB · Compass
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MongoDB Compass

In the same product, most dangerous first.

CVE-2026-96750HIGHShell script injection via server-supplied database name in Open MongoDB shellEPSS 0.2%