EUVD-2026-47781

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881

CVE-2026-14881 affects MongoDB Compass: during imports of connections, an attacker can override connection options that are not normally changeable via the connection form. Specifically, a custom browser open command for the OIDC authentication flow can be injected, which is typically configured ...

@mongodb-js/compass-home (>=0.0.0-next-027f8a3b23cf15c7c592ce82b59ba9007ea85602, <=0.0.0-next-fb4a1f2a7bd24298659048854c23ace5519cc4c8) potentially affected by CVE-2026-9101 via @mongodb-js/compass-import-export (>=0.0.0-next-027f8a3b23cf15c7c592ce82b59ba9007ea85602, <=0.0.0-next-fb4a1f2a7bd24298659048854c23ace5519cc4c8)

@mongodb-js/compass-import-export NPM version =0.0.0-next-027f8a3b23cf15c7c592ce82b59ba9007ea85602, =0.0.0-next-027f8a3b23cf15c7c592ce82b59ba9007ea85602, =0.0.0-next-fb4a1f2a7bd24298659048854c23ace5519cc4c8 Source cves: CVE-2026-9101 Source advisory: MEND:CVE-2026-9101...