CVE-2026-9101

EUVD-2026-31127
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Prototype Pollution
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.07%
Affected Products (NVD)
VendorProductVersion
mongodbcompass
1.36.3
mongodbcompass
1.36.4
mongodbcompass
1.37.0
mongodbcompass
1.38.0
mongodbcompass
1.38.1
mongodbcompass
1.38.2
mongodbcompass
1.39.0
mongodbcompass
1.39.1
mongodbcompass
1.39.2
mongodbcompass
1.39.3
mongodbcompass
1.39.4
mongodbcompass
1.40.0
mongodbcompass
1.40.1
mongodbcompass
1.40.2
mongodbcompass
1.40.3
mongodbcompass
1.40.4
mongodbcompass
1.41.0
mongodbcompass
1.42.0
mongodbcompass
1.42.1
mongodbcompass
1.42.2
mongodbcompass
1.42.3
mongodbcompass
1.42.5
mongodbcompass
1.43.0
mongodbcompass
1.43.1
mongodbcompass
1.43.2
mongodbcompass
1.43.3
mongodbcompass
1.43.4
mongodbcompass
1.43.5
mongodbcompass
1.43.6
mongodbcompass
1.44.0
mongodbcompass
1.44.3
mongodbcompass
1.44.4
mongodbcompass
1.44.5
mongodbcompass
1.44.6
mongodbcompass
1.44.7
mongodbcompass
1.45.0
mongodbcompass
1.45.1
mongodbcompass
1.45.2
mongodbcompass
1.45.3
mongodbcompass
1.45.4
mongodbcompass
1.46.0
mongodbcompass
1.46.1
mongodbcompass
1.46.2
mongodbcompass
1.46.3
mongodbcompass
1.46.4
mongodbcompass
1.46.5
mongodbcompass
1.46.6
mongodbcompass
1.46.7
mongodbcompass
1.46.8
mongodbcompass
1.46.9
mongodbcompass
1.46.10
mongodbcompass
1.46.11
mongodbcompass
1.47.0
mongodbcompass
1.47.1
mongodbcompass
1.48.0
mongodbcompass
1.48.1
mongodbcompass
1.48.2
mongodbcompass
1.49.0
mongodbcompass
1.49.1
mongodbcompass
1.49.2
mongodbcompass
1.49.3
mongodbcompass
1.49.4
mongodbcompass
1.49.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/COMPASS-10657