Is CVE-2026-9101 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9101 being exploited in the wild.

How severe is CVE-2026-9101?

Medium severity, with a CVSS score of 4.3, published 20 May 2026.

Which products and versions are affected?

MongoDB Compass versions prior to 1.49.6.

Is there a fix for CVE-2026-9101?

A patch was published on 2026-05-06: Issue resolved/fixed in development Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9101 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9101?

Check whether you run MongoDB Compass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9101: MongoDB Compass prototype pollution in CSV import

CVE-2026-9101 · Severity: medium · CVSS 4.3 · Published 2026-05-20

MongoDB Compass, a graphical interface for managing MongoDB databases, is vulnerable to a security flaw when importing CSV files. An attacker could provide a specially crafted CSV file that, when processed by a user, causes the application to open unintended file paths. This could lead to the execution of malicious commands on the user's local system if they interact with the application after the import.

Technologies: MongoDB Compass. Vendors: MongoDB.

Quick answers

Is CVE-2026-9101 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9101 being exploited in the wild.
How severe is CVE-2026-9101?: Medium severity, with a CVSS score of 4.3, published 20 May 2026.
Which products and versions are affected?: MongoDB Compass versions prior to 1.49.6.
Is there a fix for CVE-2026-9101?: A patch was published on 2026-05-06: Issue resolved/fixed in development Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9101 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9101?: Check whether you run MongoDB Compass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A prototype pollution vulnerability (CWE-1321) exists in the CSV parsing logic of MongoDB Compass during the data import process. By crafting a malicious CSV file, an attacker can pollute the object prototype, which subsequently influences the 'shell.openExternal' function in the Electron-based environment. While the vulnerability does not allow for direct argument injection, it enables the injection of untrusted file paths. Successful exploitation requires a user to import the malicious file and perform specific subsequent actions, resulting in a '1-click' command execution scenario. The issue is resolved in MongoDB Compass version 1.49.6.

Affected products

MongoDB Compass versions prior to 1.49.6

Timeline

2026-05-05: other: Issue reported internally/created in Jira
2026-05-06: patched: Issue resolved/fixed in development
2026-05-20: advisory: CVE published and NVD record created

References

https://jira.mongodb.org/browse/COMPASS-10657

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.