CVE-2026-14881

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada mongodb compass. Skor CVSS 3.1 7.8 (High) menurut mongodb.com.

Deskripsi (NVD)

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

Rincian

Terbit di NVD

22 Juli 2026

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber mongodb.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mongodb-js/compass/releases/tag/v1.49.7 release notes