MongoDB Compass: Arbitrary code execution via crafted BSON values (CVE-2026-113870)
MongoDB Compass is vulnerable to arbitrary code execution when processing specially crafted BSON values from a stored view aggregation pipeline during an editing operation.
CVE search metadata
CVE search record: CVE-2026-113870. Severity: high. CVSS: 8.8. KEV: no. Product: Compass. Brief: MongoDB Compass: Arbitrary code execution via crafted BSON values (CVE-2026-113870). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-compass-rce/
Triage facts
Revision 1- Applicability
- Compass
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 19:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-113870 affects MongoDB Compass when converting a stored view aggregation pipeline into an editable source format. The vulnerability stems from improper escaping of BSON values, allowing for arbitrary code execution with the privileges of the application user. Exploitation requires an attacker to successfully store a malicious view within a MongoDB deployment and subsequently entice an authorized user to open that view for editing using Compass.
Impact
Successful exploitation results in arbitrary code execution on the host machine running MongoDB Compass. The impact is limited by the permissions of the local user running the application.
Recommendation
- Inventory all systems running MongoDB Compass and prepare for updates to the version patched for CVE-2026-113870.
- Advise database administrators and developers to exercise caution when opening or editing views in shared or untrusted MongoDB environments.
Immediate actions
Patch or upgrade MongoDB Compass to the version containing the fix for CVE-2026-113870.
Mitigations
Advise users to avoid opening views from untrusted or public MongoDB databases within Compass.
CVE-2026-113870