{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amongodbcompass/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-113870"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Compass"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","mongodb"],"_cs_type":"advisory","_cs_vendors":["MongoDB"],"content_html":"\u003cp\u003eCVE-2026-113870 affects MongoDB Compass when converting a stored view aggregation pipeline into an editable source format. The vulnerability stems from improper escaping of BSON values, allowing for arbitrary code execution with the privileges of the application user. Exploitation requires an attacker to successfully store a malicious view within a MongoDB deployment and subsequently entice an authorized user to open that view for editing using Compass.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution on the host machine running MongoDB Compass. The impact is limited by the permissions of the local user running the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all systems running MongoDB Compass and prepare for updates to the version patched for CVE-2026-113870.\u003c/li\u003e\n\u003cli\u003eAdvise database administrators and developers to exercise caution when opening or editing views in shared or untrusted MongoDB environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T19:59:06Z","date_published":"2026-10-21T19:59:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mongodb-compass-rce/","summary":"MongoDB Compass is vulnerable to arbitrary code execution when processing specially crafted BSON values from a stored view aggregation pipeline during an editing operation.","title":"MongoDB Compass: Arbitrary code execution via crafted BSON values (CVE-2026-113870)","url":"https://feed.craftedsignal.io/briefs/2026-10-mongodb-compass-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}