ejson shell parser in MongoDB Compass maybe bypassed

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-6376 · ADVISORY
• mongodb-js/compass commit b1f8050 · WEB
• mongodb-js/compass · PACKAGE
• jira.mongodb.org/browse/COMPASS-7496 · WEB

compass のその他の脆弱性

• CVE-2026-14881高 7.8When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection …
• CVE-2026-9101中 4.3Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal afte…
• CVE-2025-1755高 7.8MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a use…
• CVE-2024-3371中 6.8MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application b…
• CVE-2021-20334高 7.8A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the pr…