CVE-2026-9101

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9101", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "state": "PUBLISHED", "assignerShortName": "mongodb", "dateReserved": "2026-05-20T16:03:25.137Z", "datePublished": "2026-05-20T16:18:10.689Z", "dateUpdated": "2026-05-27T13:10:03.012Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2026-05-20T16:18:10.689Z"}, "title": "Prototype pollution in csv parsing", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "affected": [{"vendor": "MongoDB, Inc.", "product": "Compass", "versions": [{"status": "affected", "version": "1.36.3"}, {"status": "affected", "version": "1.36.4"}, {"status": "affected", "version": "1.37.0"}, {"status": "affected", "version": "1.38.0"}, {"status": "affected", "version": "1.38.1"}, {"status": "affected", "version": "1.38.2"}, {"status": "affected", "version": "1.39.0"}, {"status": "affected", "version": "1.39.1"}, {"status": "affected", "version": "1.39.2"}, {"status": "affected", "version": "1.39.3"}, {"status": "affected", "version": "1.39.4"}, {"status": "affected", "version": "1.40.0"}, {"status": "affected", "version": "1.40.1"}, {"status": "affected", "version": "1.40.2"}, {"status": "affected", "version": "1.40.3"}, {"status": "affected", "version": "1.40.4"}, {"status": "affected", "version": "1.41.0"}, {"status": "affected", "version": "1.42.0"}, {"status": "affected", "version": "1.42.1"}, {"status": "affected", "version": "1.42.2"}, {"status": "affected", "version": "1.42.3"}, {"status": "affected", "version": "1.42.5"}, {"status": "affected", "version": "1.43.0"}, {"status": "affected", "version": "1.43.1"}, {"status": "affected", "version": "1.43.2"}, {"status": "affected", "version": "1.43.3"}, {"status": "affected", "version": "1.43.4"}, {"status": "affected", "version": "1.43.5"}, {"status": "affected", "version": "1.43.6"}, {"status": "affected", "version": "1.44.0"}, {"status": "affected", "version": "1.44.3"}, {"status": "affected", "version": "1.44.4"}, {"status": "affected", "version": "1.44.5"}, {"status": "affected", "version": "1.44.6"}, {"status": "affected", "version": "1.44.7"}, {"status": "affected", "version": "1.45.0"}, {"status": "affected", "version": "1.45.1"}, {"status": "affected", "version": "1.45.2"}, {"status": "affected", "version": "1.45.3"}, {"status": "affected", "version": "1.45.4"}, {"status": "affected", "version": "1.46.0"}, {"status": "affected", "version": "1.46.1"}, {"status": "affected", "version": "1.46.2"}, {"status": "affected", "version": "1.46.3"}, {"status": "affected", "version": "1.46.4"}, {"status": "affected", "version": "1.46.5"}, {"status": "affected", "version": "1.46.6"}, {"status": "affected", "version": "1.46.7"}, {"status": "affected", "version": "1.46.8"}, {"status": "affected", "version": "1.46.9"}, {"status": "affected", "version": "1.46.10"}, {"status": "affected", "version": "1.46.11"}, {"status": "affected", "version": "1.47.0"}, {"status": "affected", "version": "1.47.1"}, {"status": "affected", "version": "1.48.0"}, {"status": "affected", "version": "1.48.1"}, {"status": "affected", "version": "1.48.2"}, {"status": "affected", "version": "1.49.0"}, {"status": "affected", "version": "1.49.1"}, {"status": "affected", "version": "1.49.2"}, {"status": "affected", "version": "1.49.3"}, {"status": "affected", "version": "1.49.4"}, {"status": "affected", "version": "1.49.5"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution."}]}], "references": [{"url": "https://jira.mongodb.org/browse/COMPASS-10657", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-23T03:55:43.091186Z", "id": "CVE-2026-9101", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:10:03.012Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9101", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-23T03:55:43.091186Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T17:48:10.928Z"}}], "cna": {"title": "Prototype pollution in csv parsing", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MongoDB, Inc.", "product": "Compass", "versions": [{"status": "affected", "version": "1.36.3"}, {"status": "affected", "version": "1.36.4"}, {"status": "affected", "version": "1.37.0"}, {"status": "affected", "version": "1.38.0"}, {"status": "affected", "version": "1.38.1"}, {"status": "affected", "version": "1.38.2"}, {"status": "affected", "version": "1.39.0"}, {"status": "affected", "version": "1.39.1"}, {"status": "affected", "version": "1.39.2"}, {"status": "affected", "version": "1.39.3"}, {"status": "affected", "version": "1.39.4"}, {"status": "affected", "version": "1.40.0"}, {"status": "affected", "version": "1.40.1"}, {"status": "affected", "version": "1.40.2"}, {"status": "affected", "version": "1.40.3"}, {"status": "affected", "version": "1.40.4"}, {"status": "affected", "version": "1.41.0"}, {"status": "affected", "version": "1.42.0"}, {"status": "affected", "version": "1.42.1"}, {"status": "affected", "version": "1.42.2"}, {"status": "affected", "version": "1.42.3"}, {"status": "affected", "version": "1.42.5"}, {"status": "affected", "version": "1.43.0"}, {"status": "affected", "version": "1.43.1"}, {"status": "affected", "version": "1.43.2"}, {"status": "affected", "version": "1.43.3"}, {"status": "affected", "version": "1.43.4"}, {"status": "affected", "version": "1.43.5"}, {"status": "affected", "version": "1.43.6"}, {"status": "affected", "version": "1.44.0"}, {"status": "affected", "version": "1.44.3"}, {"status": "affected", "version": "1.44.4"}, {"status": "affected", "version": "1.44.5"}, {"status": "affected", "version": "1.44.6"}, {"status": "affected", "version": "1.44.7"}, {"status": "affected", "version": "1.45.0"}, {"status": "affected", "version": "1.45.1"}, {"status": "affected", "version": "1.45.2"}, {"status": "affected", "version": "1.45.3"}, {"status": "affected", "version": "1.45.4"}, {"status": "affected", "version": "1.46.0"}, {"status": "affected", "version": "1.46.1"}, {"status": "affected", "version": "1.46.2"}, {"status": "affected", "version": "1.46.3"}, {"status": "affected", "version": "1.46.4"}, {"status": "affected", "version": "1.46.5"}, {"status": "affected", "version": "1.46.6"}, {"status": "affected", "version": "1.46.7"}, {"status": "affected", "version": "1.46.8"}, {"status": "affected", "version": "1.46.9"}, {"status": "affected", "version": "1.46.10"}, {"status": "affected", "version": "1.46.11"}, {"status": "affected", "version": "1.47.0"}, {"status": "affected", "version": "1.47.1"}, {"status": "affected", "version": "1.48.0"}, {"status": "affected", "version": "1.48.1"}, {"status": "affected", "version": "1.48.2"}, {"status": "affected", "version": "1.49.0"}, {"status": "affected", "version": "1.49.1"}, {"status": "affected", "version": "1.49.2"}, {"status": "affected", "version": "1.49.3"}, {"status": "affected", "version": "1.49.4"}, {"status": "affected", "version": "1.49.5"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://jira.mongodb.org/browse/COMPASS-10657", "tags": ["issue-tracking"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution.", "supportingMedia": [{"type": "text/html", "value": "Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2026-05-20T16:18:10.689Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9101", "state": "PUBLISHED", "dateUpdated": "2026-05-27T13:10:03.012Z", "dateReserved": "2026-05-20T16:03:25.137Z", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "datePublished": "2026-05-20T16:18:10.689Z", "assignerShortName": "mongodb"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Compass", "vendor": "MongoDB, Inc.", "versions": [{"status": "affected", "version": "1.36.3"}, {"status": "affected", "version": "1.36.4"}, {"status": "affected", "version": "1.37.0"}, {"status": "affected", "version": "1.38.0"}, {"status": "affected", "version": "1.38.1"}, {"status": "affected", "version": "1.38.2"}, {"status": "affected", "version": "1.39.0"}, {"status": "affected", "version": "1.39.1"}, {"status": "affected", "version": "1.39.2"}, {"status": "affected", "version": "1.39.3"}, {"status": "affected", "version": "1.39.4"}, {"status": "affected", "version": "1.40.0"}, {"status": "affected", "version": "1.40.1"}, {"status": "affected", "version": "1.40.2"}, {"status": "affected", "version": "1.40.3"}, {"status": "affected", "version": "1.40.4"}, {"status": "affected", "version": "1.41.0"}, {"status": "affected", "version": "1.42.0"}, {"status": "affected", "version": "1.42.1"}, {"status": "affected", "version": "1.42.2"}, {"status": "affected", "version": "1.42.3"}, {"status": "affected", "version": "1.42.5"}, {"status": "affected", "version": "1.43.0"}, {"status": "affected", "version": "1.43.1"}, {"status": "affected", "version": "1.43.2"}, {"status": "affected", "version": "1.43.3"}, {"status": "affected", "version": "1.43.4"}, {"status": "affected", "version": "1.43.5"}, {"status": "affected", "version": "1.43.6"}, {"status": "affected", "version": "1.44.0"}, {"status": "affected", "version": "1.44.3"}, {"status": "affected", "version": "1.44.4"}, {"status": "affected", "version": "1.44.5"}, {"status": "affected", "version": "1.44.6"}, {"status": "affected", "version": "1.44.7"}, {"status": "affected", "version": "1.45.0"}, {"status": "affected", "version": "1.45.1"}, {"status": "affected", "version": "1.45.2"}, {"status": "affected", "version": "1.45.3"}, {"status": "affected", "version": "1.45.4"}, {"status": "affected", "version": "1.46.0"}, {"status": "affected", "version": "1.46.1"}, {"status": "affected", "version": "1.46.2"}, {"status": "affected", "version": "1.46.3"}, {"status": "affected", "version": "1.46.4"}, {"status": "affected", "version": "1.46.5"}, {"status": "affected", "version": "1.46.6"}, {"status": "affected", "version": "1.46.7"}, {"status": "affected", "version": "1.46.8"}, {"status": "affected", "version": "1.46.9"}, {"status": "affected", "version": "1.46.10"}, {"status": "affected", "version": "1.46.11"}, {"status": "affected", "version": "1.47.0"}, {"status": "affected", "version": "1.47.1"}, {"status": "affected", "version": "1.48.0"}, {"status": "affected", "version": "1.48.1"}, {"status": "affected", "version": "1.48.2"}, {"status": "affected", "version": "1.49.0"}, {"status": "affected", "version": "1.49.1"}, {"status": "affected", "version": "1.49.2"}, {"status": "affected", "version": "1.49.3"}, {"status": "affected", "version": "1.49.4"}, {"status": "affected", "version": "1.49.5"}]}], "source": "cna@mongodb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:compass:1.36.3:*:*:*:*:*:*:*", "matchCriteriaId": "FCB04375-C50B-4682-9740-CCDF87E7308E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.36.4:*:*:*:*:*:*:*", "matchCriteriaId": "60B512D2-2DD2-4F0D-9F22-243A78B63600", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*", "matchCriteriaId": "5951B0FB-F22B-49E3-BF5E-BBFBBACBEAB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*", "matchCriteriaId": "0C05F08F-E151-4379-8512-000CB9501175", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*", "matchCriteriaId": "67B6171A-04E2-4E76-8E35-CC8BDDBE3FB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*", "matchCriteriaId": "87CEF75A-E6F0-4267-8E32-755547EC0BC6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*", "matchCriteriaId": "23AED71A-1E29-4E38-8C33-BD430958326A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*", "matchCriteriaId": "83EDE529-DB9C-46FD-AEB9-F5E306667296", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*", "matchCriteriaId": "2FEF2D02-A166-435E-86FB-77A29C4823BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*", "matchCriteriaId": "106CE2B5-96AC-4960-B7BB-95B45F9C59C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*", "matchCriteriaId": "53EC52A0-DBD9-4507-BCDB-9AE203871F3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*", "matchCriteriaId": "6186A98A-A6A3-4EC6-978A-EC895939A4FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*", "matchCriteriaId": "CA2A8EF3-1DA8-40EC-BED3-EC6D2E987D91", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*", "matchCriteriaId": "B70D7506-45D1-4D49-AD18-0F3A1B15FBB7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*", "matchCriteriaId": "8D1F9757-DF22-4B8E-B3CD-9B37206AC6DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*", "matchCriteriaId": "65861C12-4DCC-4206-8CFC-BDA1F04D4501", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.41.0:*:*:*:*:*:*:*", "matchCriteriaId": "3575976B-069C-4C09-BC1C-68E96C61B050", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*", "matchCriteriaId": "20CF8163-34AF-430C-942F-9FF2F8DA57B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.1:*:*:*:*:*:*:*", "matchCriteriaId": "3191107A-8C86-4B4E-8A6F-562E4E619421", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.2:*:*:*:*:*:*:*", "matchCriteriaId": "C04FAFE3-6D85-477A-8F2F-DC9F483E78EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.3:*:*:*:*:*:*:*", "matchCriteriaId": "2C738C35-9644-471A-BD79-8A4311960253", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.42.5:*:*:*:*:*:*:*", "matchCriteriaId": "E65122B4-6152-4E75-A8EC-40F9902E01C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.0:*:*:*:*:*:*:*", "matchCriteriaId": "B4CD9933-0BD5-4C56-B384-9820B09BFCD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.1:*:*:*:*:*:*:*", "matchCriteriaId": "586E35A1-F6A9-4E3D-90F5-3C93AF30A963", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.2:*:*:*:*:*:*:*", "matchCriteriaId": "AD3AEB2E-F3D5-4E18-9BFC-7393247C0205", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.3:*:*:*:*:*:*:*", "matchCriteriaId": "D6849C42-B84C-458D-8A4D-9AE4C7373354", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.4:*:*:*:*:*:*:*", "matchCriteriaId": "EC39A3AF-ECDE-45EA-937E-ED24A350EE76", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.5:*:*:*:*:*:*:*", "matchCriteriaId": "17F39D0F-3D92-4EB7-8992-D7DFBB8F975B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.43.6:*:*:*:*:*:*:*", "matchCriteriaId": "18D119EA-F54B-4BA6-A02C-211105CC1126", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.0:*:*:*:*:*:*:*", "matchCriteriaId": "135B01FB-A0DD-458D-8C75-4FD0ADE9C263", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.3:*:*:*:*:*:*:*", "matchCriteriaId": "AF009349-0B16-4FC9-82CB-A99398344864", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.4:*:*:*:*:*:*:*", "matchCriteriaId": "B7C08081-9C4F-44D2-B012-BB6B23BD1DC1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.5:*:*:*:*:*:*:*", "matchCriteriaId": "25A19DA4-8958-4D90-A6F2-E8B96BA89522", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.6:*:*:*:*:*:*:*", "matchCriteriaId": "7FBA0168-6830-4253-9B30-7BBEFFAAE434", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.44.7:*:*:*:*:*:*:*", "matchCriteriaId": "1E1479F1-6DE6-4AC4-9064-2EECCA5D512B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.0:*:*:*:*:*:*:*", "matchCriteriaId": "3E501FE0-1348-4EC0-9266-7AF6E15E9CD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.1:*:*:*:*:*:*:*", "matchCriteriaId": "258633F4-706B-409E-92CC-A8EF40FADC9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.2:*:*:*:*:*:*:*", "matchCriteriaId": "ACEE4FB8-3CA4-46B5-8048-43A135051221", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.3:*:*:*:*:*:*:*", "matchCriteriaId": "1660BAA2-0CF6-4D1B-9563-2C7C141AE86B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.45.4:*:*:*:*:*:*:*", "matchCriteriaId": "D110AA60-3EC3-40E8-A1CC-725640E420A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.0:*:*:*:*:*:*:*", "matchCriteriaId": "87F05EC3-46C0-488A-8B29-24C80143EC0A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.1:*:*:*:*:*:*:*", "matchCriteriaId": "2B9B8FA8-6983-4E07-9D8F-8B8666FEEB4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.2:*:*:*:*:*:*:*", "matchCriteriaId": "47E74E69-6B99-4965-81BF-891BA2829842", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.3:*:*:*:*:*:*:*", "matchCriteriaId": "35C3E67E-8B22-45EB-890B-6654A43C360D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.4:*:*:*:*:*:*:*", "matchCriteriaId": "AD1AEF08-748A-410A-9A69-D0258CA1F77D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.5:*:*:*:*:*:*:*", "matchCriteriaId": "06AD52CB-022A-4EEB-B62C-B3B534877922", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.6:*:*:*:*:*:*:*", "matchCriteriaId": "AA576CD0-E17B-4AFD-B4EF-58BB16B6411B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.7:*:*:*:*:*:*:*", "matchCriteriaId": "2AE2328A-CE40-4E1E-9CC9-BD85DAC43FA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.8:*:*:*:*:*:*:*", "matchCriteriaId": "A17ED038-3A13-4929-851E-02F32FE995CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.9:*:*:*:*:*:*:*", "matchCriteriaId": "4A7C1281-E207-406E-A75F-B36625CC6280", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.10:*:*:*:*:*:*:*", "matchCriteriaId": "D5123A3A-20AD-4101-B09B-6CD2DB4EFBFB", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.46.11:*:*:*:*:*:*:*", "matchCriteriaId": "0943757C-4960-4F03-BE2E-10B7495D9795", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.47.0:*:*:*:*:*:*:*", "matchCriteriaId": "A3C6B10F-F4AA-4038-BC1F-77B6562BC2E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.47.1:*:*:*:*:*:*:*", "matchCriteriaId": "D8BFC473-8327-4D7B-B56E-F831AFC0D04C", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.48.0:*:*:*:*:*:*:*", "matchCriteriaId": "F22A5001-62E8-422A-BB2A-31D112D37339", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.48.1:*:*:*:*:*:*:*", "matchCriteriaId": "87879BCC-2CF0-4694-BE6B-D8897D471609", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.48.2:*:*:*:*:*:*:*", "matchCriteriaId": "15BBC1DA-D981-42C6-BF04-208C00E32706", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.0:*:*:*:*:*:*:*", "matchCriteriaId": "74D36162-06A1-4568-96CE-EB1137BC33A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.1:*:*:*:*:*:*:*", "matchCriteriaId": "ADAAC0D7-26DD-4AA6-B6A8-41279E1D26C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.2:*:*:*:*:*:*:*", "matchCriteriaId": "2A2E5EB1-4D1F-478C-A72B-37DD0217B0D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.3:*:*:*:*:*:*:*", "matchCriteriaId": "45E8CF2D-8AD5-441D-A570-68388A9C2FE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.4:*:*:*:*:*:*:*", "matchCriteriaId": "F8721499-5234-4104-B315-410D36108A9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:compass:1.49.5:*:*:*:*:*:*:*", "matchCriteriaId": "BEEC3B02-73F9-4829-B521-326E0B5DCDF7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to \"1-click\" command execution."}, {"lang": "es", "value": "Contaminaci\u00f3n de prototipos en la l\u00f3gica de an\u00e1lisis de CSV durante la importaci\u00f3n puede llevar a que rutas de archivo no confiables (pero no argumentos) entren en shell.openExternal despu\u00e9s de un comportamiento de usuario espec\u00edfico, resultando en la ejecuci\u00f3n de comandos 'de 1 clic'."}], "id": "CVE-2026-9101", "lastModified": "2026-09-24T17:29:21.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@mongodb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@mongodb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9101", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-23T03:55:43.091186Z", "version": "2.0.3"}}]}, "published": "2026-05-20T17:16:32.517", "references": [{"source": "cna@mongodb.com", "tags": ["Vendor Advisory"], "url": "https://jira.mongodb.org/browse/COMPASS-10657"}], "sourceIdentifier": "cna@mongodb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "cna@mongodb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.36.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.36.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.37.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.38.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.38.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.38.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.39.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.39.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.39.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.39.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.39.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.40.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.40.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.40.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.40.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.40.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.41.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.42.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.42.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.42.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.42.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.42.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.44.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.44.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.44.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.44.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.44.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.44.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.45.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.45.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.45.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.45.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.45.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.46.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.47.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.47.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.48.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.48.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.48.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.49.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.49.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.49.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.49.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.49.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.49.5"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Compass", "source": "cna", "vendor": "MongoDB, Inc."}, "product": "compass", "vendor": "mongodb"}], "created": "2026-05-20T17:30:35.420841+00:00", "updated": "2026-05-20T18:30:35.990801+00:00", "vendors": ["mongodb", "mongodb$PRODUCT$compass"]}