# CVE-2024-6376: MongoDB Compass code injection in EJSON shell parser

Source: https://junglewise.ai/threats/cve-2024-6376-mongodb-compass-code-injection-in-ejson-shell-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-07-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-6376 · Severity: low · CVSS 3.1 · Published 2024-07-01

MongoDB Compass is a graphical user interface for connecting to and managing MongoDB databases. A code injection vulnerability in the EJSON shell parser could allow an attacker to execute arbitrary code when a user handles specially crafted connection strings or configuration data, potentially compromising the developer's machine and the databases they access.

Technologies: [MongoDB Compass](https://junglewise.ai/threats/technologies/compass). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-6376 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-6376 being exploited in the wild.

**How severe is CVE-2024-6376?** Low severity, with a CVSS score of 3.1, published 1 July 2024.

**Which products and versions are affected?** MongoDB Compass before 1.42.2; @mongodb-js/connection-form (npm) SEMVER:introduced=0,fixed=1.20.1.

**Is there a fix for CVE-2024-6376?** Yes. @mongodb-js/connection-form (npm): upgrade to 1.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-6376 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2024-6376?** Check whether you run MongoDB Compass or @mongodb-js/connection-form (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @mongodb-js/connection-form (npm): upgrade to 1.20.1 or later

  ```sh
  npm install @mongodb-js/connection-form@1.20.1
  ```


## Technical details

The vulnerability exists due to insufficient sandbox protection in MongoDB Compass's EJSON shell parser used during connection handling. The parser lacked proper input validation (CWE-20) and was susceptible to improper control of generation of code (CWE-94), allowing code injection. Attack requires user interaction (local attack vector with high complexity, no privilege required) when processing untrusted connection strings or EJSON data. An attacker can achieve arbitrary code execution on the user's machine. The fix involves enabling strict mode on the EJSON shell parser (commit b1f8050) and was released in version 1.42.2 of MongoDB Compass.

## Affected products

- MongoDB Compass before 1.42.2

## Identifiers

- CVE-2024-6376
- GHSA-jxr4-4prv-mh83

## Timeline

- 2024-07-01: disclosed: Published on GitHub Advisory Database
- 2024-07-01: patched: Fix released in MongoDB Compass 1.42.2

## References

- [https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51](https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51)

## Related threats

- [MongoDB Compass TLS certificate validation bypass in Electron](https://junglewise.ai/threats/cve-2026-115929-mongodb-compass-relies-on-electron-a-third-party-runtime-that)
- [MongoDB Compass code execution in BSON value escaping](https://junglewise.ai/threats/cve-2026-113870-mongodb-compass-improperly-escapes-certain-bson-values-when)
- [MongoDB Compass code injection via unescaped database name](https://junglewise.ai/threats/cve-2026-96750-mongodb-compass-can-interpolate-a-database-name-without-escaping)
- [MongoDB Compass OS command injection via connection import](https://junglewise.ai/threats/cve-2026-14881-mongodb-compass-os-command-injection-via-connection-import)
- [MongoDB Compass prototype pollution in CSV import](https://junglewise.ai/threats/cve-2026-9101-mongodb-compass-prototype-pollution-in-csv-import)