CVE-2026-113870

Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

State: Published
Severity: 8.6 High
Published: Oct 21, 2026
Updated: Oct 30, 2026
Reserved: Oct 20, 2026

Description

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	mongodb
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	mongodb

Weaknesses

CWE-116 Improper Encoding or Escaping of Output

Affected Products

Product	Versions
CompassMongoDB	1.7.0 to before 1.49.15Affected

References

https://www.mongodb.com/docs/compass/release-notes/#mongodb-compass-14915

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.