MongoDB Compass 1.44.0 < 1.49.12 Code Injection

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(359480);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-96750");

  script_name(english:"MongoDB Compass 1.44.0 < 1.49.12 Code Injection");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by a code injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of MongoDB Compass installed on the remote host is 1.44.0 prior to 1.49.12. It is, therefore, affected by a
vulnerability:

  - MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded
    MongoDB shell when a user opens the shell from that database's view. A user with privileges to create
    databases on a server that a Compass user connects to may, under specific conditions, have content evaluated
    as shell input within the Compass process, with that process's privileges. This requires the Compass user to
    open the shell for the affected database. (CVE-2026-96750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.mongodb.com/docs/compass/release-notes/");
  script_set_attribute(attribute:"see_also", value:"https://github.com/mongodb-js/compass/releases/tag/v1.49.12");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MongoDB Compass version 1.49.12 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-96750");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mongodb:compass");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mongodb_compass_win_installed.nbin", "macos_mongodb_compass_installed.nbin");
  script_require_keys("installed_sw/MongoDB Compass");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match_one': {'os': ['windows', 'macos']}}
  ],
  'checks': [
    {
      'product': {'name': 'MongoDB Compass', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version' : '1.44.0', 'fixed_version' : '1.49.12' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);