Read the docs
TI-2024-05918 Aliases CVE-2024-6376GHSA-jxr4-4prv-mh83

ejson shell parser in MongoDB Compass maybe bypassed

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Fixed MongoDB Compass (MongoDB Inc): 1.42.2@mongodb-js/connection-form (npm): 1.20.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoDB Compassbefore 1.42.21.42.2Patch availableCNA
—@mongodb-js/connection-form (npm)before 1.20.11.20.1Patch availableGHSA-jxr4-4prv-mh83
  • MongoDB Compass VendorMongoDB Affected before 1.42.2 Fixed in 1.42.2 Patch available CNA
  • @mongodb-js/connection-form (npm) Vendor— Affected before 1.20.1 Fixed in 1.20.1 Patch available GHSA-jxr4-4prv-mh83

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:*before 1.42.2VulnerableMongoDB
  • cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:* Versions before 1.42.2 Vulnerable ·MongoDB

Remediation

  • Fix · CNA MongoDB Compass (MongoDB Inc) Fixed in 1.42.2
  • Fix · GHSA-jxr4-4prv-mh83 @mongodb-js/connection-form (npm) Fixed in 1.20.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6376
  2. 2026-10-03 Alias added: GHSA-jxr4-4prv-mh83

References

Patch 1

Advisory 1

Other 2

  • TI-2026-12544 OS command injection in MongoDB Compass CVSS 4.0HIGH 8.4
  • TI-2025-01512 MongoDB Compass may be susceptible to local privilege escalation in Windows CVSS 3.1HIGH 7.8
  • TI-2021-03622 Local privilege escalation in MongoDB Compass for Windows CVSS 3.1HIGH 7.8
  • TI-2024-03155 Insufficient validation of external input in Compass may enable MITM attacks CVSS 3.1HIGH 7.1
  • TI-2026-07998 Prototype pollution in MongoDB Compass CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences