CVE-2026-113870 in Compass
Summary
by MITRE • 10/21/2026
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in MongoDB Compass represents a critical security flaw rooted in improper input validation and sanitization during the conversion of stored aggregation pipelines into editable source code. As a widely used graphical interface for interacting with MongoDB deployments, Compass allows users to visualize data and modify existing views through an intuitive editor that translates visual pipeline stages back into their underlying JavaScript or JSON representation. The core technical failure occurs when the application processes BSON values associated with these stored views. Specifically, the software fails to correctly escape special characters or control sequences within certain BSON fields before injecting them into the editable source context. This lack of rigorous escaping creates a classic injection vector where maliciously crafted data can break out of its intended string boundaries and be interpreted as executable code by the underlying engine that renders or processes the view definition.
From an operational perspective, this flaw allows for arbitrary code execution with the privileges of the user running the Compass application. When a user connects to a MongoDB deployment containing a specially crafted view designed to exploit this parsing error, simply opening the view in edit mode triggers the vulnerability. The attacker does not need direct access to the database server or elevated system permissions; instead, they rely on social engineering or compromised credentials to get an authorized user to open the maliciously constructed view within Compass. Once triggered, the improperly escaped values are processed by the application's internal logic, leading to the execution of arbitrary commands. This effectively bypasses standard authentication and authorization controls because the code executes in the context of the local client process rather than directly on the database server, yet it can still be used to exfiltrate sensitive data from the connected deployment or pivot into other parts of the network depending on how Compass is configured and what resources are accessible to that user.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) as well as CWE-94 Improper Control of Generation of Code (Code Injection). The attack vector leverages the trust placed in the application's ability to safely render and edit complex data structures. In terms of the MITRE ATT&CK framework, this behavior is consistent with techniques involving command injection via client-side applications or potentially T1059 Command and Scripting Interpreter if the execution context allows for broader system interaction. The severity is heightened by the fact that MongoDB Compass is a trusted administrative tool often used by database administrators who possess high-level privileges within their environments. Consequently, compromising this application can lead to significant data breaches or complete takeover of the associated infrastructure.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution involves applying the official patches released by MongoDB that address the BSON escaping logic in Compass versions affected by this flaw. Administrators should ensure all instances of MongoDB Compass are updated to the latest secure version immediately upon availability. In environments where updating is not instantly feasible, organizations should implement strict network segmentation policies to limit which systems can access sensitive MongoDB deployments and restrict the use of graphical tools like Compass on untrusted or public-facing networks. Additionally, security teams should enforce principle of least privilege for database users, ensuring that even if a client-side compromise occurs through this vulnerability, the scope of damage is contained by limiting the permissions associated with those specific accounts. Regular audits of stored views and aggregation pipelines can also help identify any suspiciously crafted data structures before they are opened in vulnerable versions of the software.