CVE-2026-96750

MongoDB Compass is vulnerable to a shell script injection because it fails to escape database names when interpolating them into the initial input of its embedded MongoDB shell . If a user opens the shell from a specific database's view, an attacker with privileges to create databases on the conn...