CyberRota Analysis
AI-GeneratedMongoDB Compass is vulnerable due to improper input handling, allowing a user with database creation privileges to execute shell commands within the Compass process. This could lead to unauthorized command execution with the same privileges as the Compass user, potentially compromising the database environment. Organizations using MongoDB Compass, especially those with users who have elevated privileges, should prioritize addressing this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.