Executive brief
The MongoDB extension for Visual Studio Code fails to sanitize special characters in connection strings before passing them to the terminal. An attacker can trick a developer into accepting a malicious connection target, and when the extension's shell feature is used, arbitrary characters can be injected into the command line—potentially leading to unintended command execution. The developer sees no clear indication of the malicious input before it runs.
Technical details
The vulnerability is a command injection flaw in the MongoDB Visual Studio Code extension. The extension composes command-line arguments from user-supplied connection strings without properly neutralizing special characters, allowing an attacker to inject arbitrary shell metacharacters. The attack vector requires social engineering (convincing a developer to accept a malicious connection target and then open the shell feature), but no local privileges or additional authentication are needed. An attacker can inject characters into the composed command line, potentially achieving arbitrary code execution in the context of the developer's machine. A patch is expected to sanitize the connection string input before it reaches the terminal.
Affected products
- MongoDB extension for Visual Studio Code <UNKNOWN>
Timeline
- 2026-09-03: disclosed