Vulnerability Details CVE-2026-9101
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 38.4%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2026-9101
-
cpe:2.3:a:mongodb:compass:1.36.3
-
cpe:2.3:a:mongodb:compass:1.36.4
-
cpe:2.3:a:mongodb:compass:1.37.0
-
cpe:2.3:a:mongodb:compass:1.38.0
-
cpe:2.3:a:mongodb:compass:1.38.1
-
cpe:2.3:a:mongodb:compass:1.38.2
-
cpe:2.3:a:mongodb:compass:1.39.0
-
cpe:2.3:a:mongodb:compass:1.39.1
-
cpe:2.3:a:mongodb:compass:1.39.2
-
cpe:2.3:a:mongodb:compass:1.39.3
-
cpe:2.3:a:mongodb:compass:1.39.4
-
cpe:2.3:a:mongodb:compass:1.40.0
-
cpe:2.3:a:mongodb:compass:1.40.1
-
cpe:2.3:a:mongodb:compass:1.40.2
-
cpe:2.3:a:mongodb:compass:1.40.3
-
cpe:2.3:a:mongodb:compass:1.40.4
-
cpe:2.3:a:mongodb:compass:1.41.0
-
cpe:2.3:a:mongodb:compass:1.42.0
-
cpe:2.3:a:mongodb:compass:1.42.1
-
cpe:2.3:a:mongodb:compass:1.42.2
-
cpe:2.3:a:mongodb:compass:1.42.3
-
cpe:2.3:a:mongodb:compass:1.42.5
-
cpe:2.3:a:mongodb:compass:1.43.0
-
cpe:2.3:a:mongodb:compass:1.43.1
-
cpe:2.3:a:mongodb:compass:1.43.2
-
cpe:2.3:a:mongodb:compass:1.43.3
-
cpe:2.3:a:mongodb:compass:1.43.4
-
cpe:2.3:a:mongodb:compass:1.43.5
-
cpe:2.3:a:mongodb:compass:1.43.6
-
cpe:2.3:a:mongodb:compass:1.44.0
-
cpe:2.3:a:mongodb:compass:1.44.3
-
cpe:2.3:a:mongodb:compass:1.44.4
-
cpe:2.3:a:mongodb:compass:1.44.5
-
cpe:2.3:a:mongodb:compass:1.44.6
-
cpe:2.3:a:mongodb:compass:1.44.7
-
cpe:2.3:a:mongodb:compass:1.45.0
-
cpe:2.3:a:mongodb:compass:1.45.1
-
cpe:2.3:a:mongodb:compass:1.45.2
-
cpe:2.3:a:mongodb:compass:1.45.3
-
cpe:2.3:a:mongodb:compass:1.45.4
-
cpe:2.3:a:mongodb:compass:1.46.0
-
cpe:2.3:a:mongodb:compass:1.46.1
-
cpe:2.3:a:mongodb:compass:1.46.10
-
cpe:2.3:a:mongodb:compass:1.46.11
-
cpe:2.3:a:mongodb:compass:1.46.2
-
cpe:2.3:a:mongodb:compass:1.46.3
-
cpe:2.3:a:mongodb:compass:1.46.4
-
cpe:2.3:a:mongodb:compass:1.46.5
-
cpe:2.3:a:mongodb:compass:1.46.6
-
cpe:2.3:a:mongodb:compass:1.46.7
-
cpe:2.3:a:mongodb:compass:1.46.8
-
cpe:2.3:a:mongodb:compass:1.46.9
-
cpe:2.3:a:mongodb:compass:1.47.0
-
cpe:2.3:a:mongodb:compass:1.47.1
-
cpe:2.3:a:mongodb:compass:1.48.0
-
cpe:2.3:a:mongodb:compass:1.48.1
-
cpe:2.3:a:mongodb:compass:1.48.2
-
cpe:2.3:a:mongodb:compass:1.49.0
-
cpe:2.3:a:mongodb:compass:1.49.1
-
cpe:2.3:a:mongodb:compass:1.49.2
-
cpe:2.3:a:mongodb:compass:1.49.3
-
cpe:2.3:a:mongodb:compass:1.49.4
-
cpe:2.3:a:mongodb:compass:1.49.5