CVE-2026-9101
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior le…
Published May 20, 2026 · updated Sep 24, 2026 · mongodb compass
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 20, 2026 · NIST NVD
Detected
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Sep 24, 2026 · NIST NVD
Updated
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Affected
- cpe mongodb/compass1.36.3
- cpe mongodb/compass1.36.4
- cpe mongodb/compass1.37.0
- cpe mongodb/compass1.38.0
- cpe mongodb/compass1.38.1
- cpe mongodb/compass1.38.2
- cpe mongodb/compass1.39.0
- cpe mongodb/compass1.39.1
Sources
- CVE.orgVulnerability recordCVE-2026-9101
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-9101
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
nvd.nist.gov