MongoDB VSCode Extension Command Injection via Connection String
CVE-2026-84967 Published on September 3, 2026
Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-users choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.
Vulnerability Analysis
CVE-2026-84967 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-84967 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-84967
Want to know whenever a new CVE is published for MongoDB? stack.watch will email you.
Affected Versions
MongoDB for VS Code:- Version 1.13.0 and below 1.17.1 is affected.