# CVE-2026-96750: MongoDB Compass code injection via unescaped database name

Source: https://junglewise.ai/threats/cve-2026-96750-mongodb-compass-can-interpolate-a-database-name-without-escaping  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96750 · Severity: high · CVSS 7.1 · Published 2026-09-24

MongoDB Compass, a database management interface, interpolates database names into shell commands without proper escaping. An attacker with privileges to create databases on a connected server can craft a malicious database name that executes arbitrary commands within the Compass process when a user opens the embedded shell for that database. This could allow command execution with the privileges of the Compass application.

Technologies: [MongoDB Compass](https://junglewise.ai/threats/technologies/compass). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-96750 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96750 being exploited in the wild.

**How severe is CVE-2026-96750?** High severity, with a CVSS score of 7.1, published 24 September 2026.

**Which products and versions are affected?** MongoDB Compass 1.44.0 through 1.49.11.

**Is there a fix for CVE-2026-96750?** A patch was published on 2026-07-14: Fixed in v1.49.12 with database name escaping (COMPASS-10810) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96750 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96750?** Check whether you run MongoDB Compass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper input sanitization of database names when passed as initial input to the embedded MongoDB shell within Compass. An unauthenticated attacker (or one with database creation privileges on a server the Compass user connects to) can create a database with a name containing shell metacharacters or commands that are evaluated when a user opens the shell from the affected database's view. The attack requires user interaction (opening the shell) and results in arbitrary code execution within the Compass process context.

## Affected products

- MongoDB Compass 1.44.0 through 1.49.11

## Timeline

- 2026-09-24: disclosed
- 2026-07-14: patched: Fixed in v1.49.12 with database name escaping (COMPASS-10810)

## References

- [https://github.com/mongodb-js/compass/releases/tag/v1.49.12](https://github.com/mongodb-js/compass/releases/tag/v1.49.12)

## Related threats

- [MongoDB Compass TLS certificate validation bypass in Electron](https://junglewise.ai/threats/cve-2026-115929-mongodb-compass-relies-on-electron-a-third-party-runtime-that)
- [MongoDB Compass code execution in BSON value escaping](https://junglewise.ai/threats/cve-2026-113870-mongodb-compass-improperly-escapes-certain-bson-values-when)
- [MongoDB Compass OS command injection via connection import](https://junglewise.ai/threats/cve-2026-14881-mongodb-compass-os-command-injection-via-connection-import)
- [MongoDB Compass prototype pollution in CSV import](https://junglewise.ai/threats/cve-2026-9101-mongodb-compass-prototype-pollution-in-csv-import)
- [MongoDB Compass code injection in EJSON shell parser](https://junglewise.ai/threats/cve-2024-6376-mongodb-compass-code-injection-in-ejson-shell-parser)