4.3Mittel
CVE-2026-9101Prototype pollution in csv parsing
Beschreibung
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Schwachstellentyp (CWE):
CWE-1321
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| MongoDB, Inc. | Compass | 1.36.3, 1.36.4, 1.37.0, 1.38.0, 1.38.1, 1.38.2, 1.39.0, 1.39.1, 1.39.2, 1.39.3, 1.39.4, 1.40.0, 1.40.1, 1.40.2, 1.40.3, 1.40.4, 1.41.0, 1.42.0, 1.42.1, 1.42.2, 1.42.3, 1.42.5, 1.43.0, 1.43.1, 1.43.2, 1.43.3, 1.43.4, 1.43.5, 1.43.6, 1.44.0, 1.44.3, 1.44.4, 1.44.5, 1.44.6, 1.44.7, 1.45.0, 1.45.1, 1.45.2, 1.45.3, 1.45.4, 1.46.0, 1.46.1, 1.46.2, 1.46.3, 1.46.4, 1.46.5, 1.46.6, 1.46.7, 1.46.8, 1.46.9, 1.46.10, 1.46.11, 1.47.0, 1.47.1, 1.48.0, 1.48.1, 1.48.2, 1.49.0, 1.49.1, 1.49.2, 1.49.3, 1.49.4, 1.49.5 |
Referenzen und Patches
- https://jira.mongodb.org/browse/COMPASS-10657 issue-trackingVendor Advisory
CPE-Treffer (NVD) (60)
cpe:2.3:a:mongodb:compass:1.36.3:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.36.4:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.41.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.42.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.42.2:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.42.3:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.42.5:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.43.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.43.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.43.2:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.43.3:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.43.4:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.43.5:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.43.6:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.44.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.44.3:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.44.4:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.44.5:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.44.6:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.44.7:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.45.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.45.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.45.2:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.45.3:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.45.4:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.2:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.3:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.4:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.5:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.6:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.7:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.8:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.9:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.10:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.46.11:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.47.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.47.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.48.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.48.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.48.2:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.49.0:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.49.1:*:*:*:*:*:*:*cpe:2.3:a:mongodb:compass:1.49.2:*:*:*:*:*:*:*