CVE-2026-9101

{"id": "CVE-2026-9101", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9101", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-23T03:55:43.091186Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB, Inc.", "product": "Compass", "versions": [{"status": "affected", "version": "1.36.3"}, {"status": "affected", "version": "1.36.4"}, {"status": "affected", "version": "1.37.0"}, {"status": "affected", "version": "1.38.0"}, {"status": "affected", "version": "1.38.1"}, {"status": "affected", "version": "1.38.2"}, {"status": "affected", "version": "1.39.0"}, {"status": "affected", "version": "1.39.1"}, {"status": "affected", "version": "1.39.2"}, {"status": "affected", "version": "1.39.3"}, {"status": "affected", "version": "1.39.4"}, {"status": "affected", "version": "1.40.0"}, {"status": "affected", "version": "1.40.1"}, {"status": "affected", "version": "1.40.2"}, {"status": "affected", "version": "1.40.3"}, {"status": "affected", "version": "1.40.4"}, {"status": "affected", "version": "1.41.0"}, {"status": "affected", "version": "1.42.0"}, {"status": "affected", "version": "1.42.1"}, {"status": "affected", "version": "1.42.2"}, {"status": "affected", "version": "1.42.3"}, {"status": "affected", "version": "1.42.5"}, {"status": "affected", "version": "1.43.0"}, {"status": "affected", "version": "1.43.1"}, {"status": "affected", "version": "1.43.2"}, {"status": "affected", "version": "1.43.3"}, {"status": "affected", "version": "1.43.4"}, {"status": "affected", "version": "1.43.5"}, {"status": "affected", "version": "1.43.6"}, {"status": "affected", "version": "1.44.0"}, {"status": "affected", "version": "1.44.3"}, {"status": "affected", "version": "1.44.4"}, {"status": "affected", "version": "1.44.5"}, {"status": "affected", "version": "1.44.6"}, {"status": "affected", "version": "1.44.7"}, {"status": "affected", "version": "1.45.0"}, {"status": "affected", "version": "1.45.1"}, {"status": "affected", "version": "1.45.2"}, {"status": "affected", "version": "1.45.3"}, {"status": "affected", "version": "1.45.4"}, {"status": "affected", "version": "1.46.0"}, {"status": "affected", "version": "1.46.1"}, {"status": "affected", "version": "1.46.2"}, {"status": "affected", "version": "1.46.3"}, {"status": "affected", "version": "1.46.4"}, {"status": "affected", "version": "1.46.5"}, {"status": "affected", "version": "1.46.6"}, {"status": "affected", "version": "1.46.7"}, {"status": "affected", "version": "1.46.8"}, {"status": "affected", "version": "1.46.9"}, {"status": "affected", "version": "1.46.10"}, {"status": "affected", "version": "1.46.11"}, {"status": "affected", "version": "1.47.0"}, {"status": "affected", "version": "1.47.1"}, {"status": "affected", "version": "1.48.0"}, {"status": "affected", "version": "1.48.1"}, {"status": "affected", "version": "1.48.2"}, {"status": "affected", "version": "1.49.0"}, {"status": "affected", "version": "1.49.1"}, {"status": "affected", "version": "1.49.2"}, {"status": "affected", "version": "1.49.3"}, {"status": "affected", "version": "1.49.4"}, {"status": "affected", "version": "1.49.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-20T17:16:32.517", "references": [{"url": "https://jira.mongodb.org/browse/COMPASS-10657", "tags": ["Vendor Advisory"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution."}, {"lang": "es", "value": "Contaminaci\u00f3n de prototipos en la l\u00f3gica de an\u00e1lisis de CSV durante la importaci\u00f3n puede llevar a que rutas de archivo no confiables (pero no argumentos) entren en shell.openExternal despu\u00e9s de un comportamiento de usuario espec\u00edfico, resultando en la ejecuci\u00f3n de comandos 'de 1 clic'."}], "lastModified": "2026-09-24T17:29:21.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:compass:1.36.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCB04375-C50B-4682-9740-CCDF87E7308E"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.36.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60B512D2-2DD2-4F0D-9F22-243A78B63600"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5951B0FB-F22B-49E3-BF5E-BBFBBACBEAB2"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C05F08F-E151-4379-8512-000CB9501175"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67B6171A-04E2-4E76-8E35-CC8BDDBE3FB2"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87CEF75A-E6F0-4267-8E32-755547EC0BC6"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23AED71A-1E29-4E38-8C33-BD430958326A"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83EDE529-DB9C-46FD-AEB9-F5E306667296"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FEF2D02-A166-435E-86FB-77A29C4823BB"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "106CE2B5-96AC-4960-B7BB-95B45F9C59C3"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53EC52A0-DBD9-4507-BCDB-9AE203871F3A"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6186A98A-A6A3-4EC6-978A-EC895939A4FE"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA2A8EF3-1DA8-40EC-BED3-EC6D2E987D91"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B70D7506-45D1-4D49-AD18-0F3A1B15FBB7"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D1F9757-DF22-4B8E-B3CD-9B37206AC6DA"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65861C12-4DCC-4206-8CFC-BDA1F04D4501"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.41.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3575976B-069C-4C09-BC1C-68E96C61B050"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20CF8163-34AF-430C-942F-9FF2F8DA57B6"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3191107A-8C86-4B4E-8A6F-562E4E619421"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C04FAFE3-6D85-477A-8F2F-DC9F483E78EE"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C738C35-9644-471A-BD79-8A4311960253"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E65122B4-6152-4E75-A8EC-40F9902E01C5"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4CD9933-0BD5-4C56-B384-9820B09BFCD4"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "586E35A1-F6A9-4E3D-90F5-3C93AF30A963"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD3AEB2E-F3D5-4E18-9BFC-7393247C0205"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6849C42-B84C-458D-8A4D-9AE4C7373354"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC39A3AF-ECDE-45EA-937E-ED24A350EE76"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17F39D0F-3D92-4EB7-8992-D7DFBB8F975B"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18D119EA-F54B-4BA6-A02C-211105CC1126"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "135B01FB-A0DD-458D-8C75-4FD0ADE9C263"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF009349-0B16-4FC9-82CB-A99398344864"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7C08081-9C4F-44D2-B012-BB6B23BD1DC1"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25A19DA4-8958-4D90-A6F2-E8B96BA89522"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FBA0168-6830-4253-9B30-7BBEFFAAE434"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E1479F1-6DE6-4AC4-9064-2EECCA5D512B"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E501FE0-1348-4EC0-9266-7AF6E15E9CD3"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "258633F4-706B-409E-92CC-A8EF40FADC9E"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACEE4FB8-3CA4-46B5-8048-43A135051221"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1660BAA2-0CF6-4D1B-9563-2C7C141AE86B"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D110AA60-3EC3-40E8-A1CC-725640E420A0"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87F05EC3-46C0-488A-8B29-24C80143EC0A"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B9B8FA8-6983-4E07-9D8F-8B8666FEEB4C"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47E74E69-6B99-4965-81BF-891BA2829842"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35C3E67E-8B22-45EB-890B-6654A43C360D"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD1AEF08-748A-410A-9A69-D0258CA1F77D"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06AD52CB-022A-4EEB-B62C-B3B534877922"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA576CD0-E17B-4AFD-B4EF-58BB16B6411B"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AE2328A-CE40-4E1E-9CC9-BD85DAC43FA1"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A17ED038-3A13-4929-851E-02F32FE995CD"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A7C1281-E207-406E-A75F-B36625CC6280"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5123A3A-20AD-4101-B09B-6CD2DB4EFBFB"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0943757C-4960-4F03-BE2E-10B7495D9795"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.47.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3C6B10F-F4AA-4038-BC1F-77B6562BC2E5"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.47.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8BFC473-8327-4D7B-B56E-F831AFC0D04C"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.48.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F22A5001-62E8-422A-BB2A-31D112D37339"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.48.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87879BCC-2CF0-4694-BE6B-D8897D471609"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.48.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15BBC1DA-D981-42C6-BF04-208C00E32706"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74D36162-06A1-4568-96CE-EB1137BC33A5"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADAAC0D7-26DD-4AA6-B6A8-41279E1D26C6"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A2E5EB1-4D1F-478C-A72B-37DD0217B0D7"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45E8CF2D-8AD5-441D-A570-68388A9C2FE8"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8721499-5234-4104-B315-410D36108A9D"}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEEC3B02-73F9-4829-B521-326E0B5DCDF7"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}