CVE-2025-1755

MongoDB Compass (Windows) is affected by CVE-2025-1755: a local privilege escalation vulnerability when a crafted file is stored in C:\node_modules, affecting versions prior to 1.42.1. The condition described enables elevated-privilege actions on the user’s system. Several connected sources (incl...

CVE-2025-1755 MongoDB Compass may be susceptible to local privilege escalation in Windows

MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\nodemodules. This issue affects MongoDB Compass prior to 1.42.1...

MongoDB Compass may be susceptible to local privilege escalation in Windows

MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\nodemodules. This issue affects MongoDB Compass prior to 1.42.1...

PT-2025-8960 · Mongodb · Mongodb Compass

Name of the Vulnerable Software and Affected Versions: MongoDB Compass versions prior to 1.42.1 Description: The issue may allow local privilege escalation under certain conditions, potentially enabling unauthorized actions on a user's system with elevated privileges. This can occur when a crafte...

MongoDB Compass 代码问题漏洞

MongoDB Compass is a free interactive tool from MongoDB, Inc. for querying, optimizing, and analyzing MongoDB data. A code issue vulnerability exists in MongoDB Compass versions prior to 1.42.1 that stems from local elevation of privilege...

CVE-2022-42447

HCL Compass is vulnerable to Cross-Origin Resource Sharing CORS. This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request...

DevDojo Voyager vulnerable to path traversal

DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass...

Voyager 安全漏洞

Voyager is an application by David Borland Personal Developer. A security vulnerability exists in Voyager version 1.8.0 and earlier, which stems from vulnerability to reflective cross-site scripting XSS attacks via /admin/compass...

Voyager 安全漏洞

Voyager is an application by David Borland Personal Developer. A security vulnerability exists in Voyager version 1.8.0 and earlier, which stems from vulnerability to path traversal attacks via /admin/compass...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS at the /admin/compass endpoint, which passes data from GET requests to the index function. This function can return unsanitized text in error message popups when it receives a file deletion request. As a result,...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path at the /admin/compass endpoint, which passes data from GET requests to the pathToLogFile function. An attacker who can convince an authenticated user to follow a link containing a malicious file nam...

The vulnerability of MongoDB Compass’s graphical interface, a database management system for MongoDB, allows attackers to gain unauthorized access to the credentials of any user.

The vulnerability of MongoDB Compass’s graphical interface, a database management system by MongoDB. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the credentials of any user...

The vulnerability of the EJSON graphical interface parser in MongoDB Compass, a database management system, allows attackers to circumvent security restrictions and execute arbitrary code.

The vulnerability of the EJSON graphical interface parser in MongoDB Compass, a database management system, is related to insufficient validation of input data. Exploiting this vulnerability allows attackers to bypass security restrictions and execute arbitrary code...

GHSA-JXR4-4PRV-MH83 ejson shell parser in MongoDB Compass maybe bypassed

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2...

@mongodb-js/compass-aggregations (=0.0.0-next-4384d1fb0545d3f19fa808079b2b78538a3277a8), @mongodb-js/compass-app-stores (=0.0.0-next-4384d1fb0545d3f19fa808079b2b78538a3277a8) +18 more potentially affected by CVE-2024-6376 via @mongodb-js/connection-form (>=0.0.0-experimental-1c53312ce4905234885618d41ae95fde9c21aa18 <=0.9.1)

@mongodb-js/connection-form NPM version =0.0.0-experimental-1c53312ce4905234885618d41ae95fde9c21aa18, =0.0.0-next-0a9492a9988b7b708d2142aa0addf1564bafaa4c, =0.0.0-experimental-1c53312ce4905234885618d41ae95fde9c21aa18, =0.0.0-experimental-1c53312ce4905234885618d41ae95fde9c21aa18, =5.29.1 -...

ejson shell parser in MongoDB Compass maybe bypassed

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2...

CVE-2024-6376

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2...

CVE-2024-6376

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2...

CVE-2024-6376 ejson shell parser in MongoDB Compass maybe bypassed

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2...

CVE-2024-6376

CVE-2024-6376 affects MongoDB Compass prior to 1.42.2. The issue arises from insufficient sandbox protection when using the ejson shell parser in Compass’ connection handling, potentially enabling code injection. Evidence across sources confirms the vulnerability is associated with Compass’ GUI a...