MongoDB Compass: CSV import prototype pollution leads to 1click exec
CVE-2026-9101 Published on May 20, 2026

Prototype pollution in csv parsing
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

NVD

Vulnerability Analysis

CVE-2026-9101 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is a Prototype Pollution Vulnerability?

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVE-2026-9101 has been classified to as a Prototype Pollution vulnerability or weakness.


Products Associated with CVE-2026-9101

Want to know whenever a new CVE is published for MongoDB Compass? stack.watch will email you.

MongoDB Compass
 

Affected Versions

MongoDB, Inc. Compass: