MongoDB Compass arbitrary code exec via BSON view injection (CVE-2026-113870)
CVE-2026-113870 Published on October 21, 2026
Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
MongoDB Compass improperly escapes certain BSON values when converting a stored views aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
Vulnerability Analysis
CVE-2026-113870 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an Output Sanitization Vulnerability?
The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVE-2026-113870 has been classified to as an Output Sanitization vulnerability or weakness.
Products Associated with CVE-2026-113870
Want to know whenever a new CVE is published for MongoDB Compass? stack.watch will email you.
Affected Versions
MongoDB Compass:- Version 1.7.0 and below 1.49.15 is affected.