Live › vulnerability › CVE-2026-113870
Go to dashboardMongoDB Compass fails to escape certain BSON values when it converts a stored view's aggregation pipeline into editable source. A user who connects to a deployment with a specially crafted view and opens that view for editing can have arbitrary code executed with their own privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Compass version under Help > About, or run the Compass package manager query for mongodb-compass and compare it to the fixed release.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
This page as .md · .json · in your agent: get_signal("CVE-2026-113870")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.