Quick answers
- Is CVE-2026-96750 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-96750 being exploited in the wild.
- How severe is CVE-2026-96750?
- High severity, with a CVSS score of 7.1, published 24 September 2026.
- Which products and versions are affected?
- MongoDB Compass 1.44.0 through 1.49.11.
- Is there a fix for CVE-2026-96750?
- A patch was published on 2026-07-14: Fixed in v1.49.12 with database name escaping (COMPASS-10810) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-96750 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-96750?
- Check whether you run MongoDB Compass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability stems from improper input sanitization of database names when passed as initial input to the embedded MongoDB shell within Compass. An unauthenticated attacker (or one with database creation privileges on a server the Compass user connects to) can create a database with a name containing shell metacharacters or commands that are evaluated when a user opens the shell from the affected database's view. The attack requires user interaction (opening the shell) and results in arbitrary code execution within the Compass process context.
Affected products
- MongoDB Compass 1.44.0 through 1.49.11
Timeline
- 2026-09-24: disclosed
- 2026-07-14: patched: Fixed in v1.49.12 with database name escaping (COMPASS-10810)