MongoDB Compass Flaw Allows Arbitrary Code Execution on View Edit

Organizations using MongoDB Compass versions prior to 1.49.15 face a high-severity security risk that could allow arbitrary code execution. The National Vulnerability Database records this issue as CVE-2026-113870 with a CVSS score of 8.8. This vulnerability stems from improper escaping of certain BSON values when the application converts a stored view’s aggregation pipeline into editable source code. If a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute. The executing code runs with the same privileges as the user operating the Compass application.

How it unfolded

• The National Vulnerability Database published a record for CVE-2026-113870, identifying the flaw in MongoDB Compass before version 1.49.15.
• The record describes that the vulnerability arises from improper escaping of BSON values during the conversion of stored views into editable source.
• The issue allows arbitrary code execution when a user opens a specially crafted view for editing within the Compass interface.

Who is affected

Any organization using MongoDB Compass versions older than 1.49.15 is exposed to this risk. The vulnerability specifically impacts users who interact with database views through the Compass graphical interface. Since the code executes with the privileges of the user running the application, any user who edits views is potentially affected. The flaw is tied to CWE-116, which relates to improper encoding and escaping of output. This means that any environment where Compass is used to manage MongoDB deployments containing views could be vulnerable if the software is a version before 1.49.15.

Our take on the response

The classification of this flaw as high severity reflects the significant potential for impact on end-user systems. Because the exploitation requires a user to open a specific view, it relies on some level of interaction, but the consequence of that interaction is severe. The fact that the code runs with user privileges means that if an attacker can influence the database content, they can potentially pivot from the database to the client machine. This underscores the importance of keeping client-side management tools updated, as they are often overlooked in patch management cycles compared to server-side components.

Who needs to act first

Teams should prioritize updating MongoDB Compass on systems used by users who edit views, as these individuals are most likely to trigger the flaw. Check inventory systems to identify all workstations running vulnerable versions before 1.49.15. Roll out the update in phases, starting with exposed environments, and verify the installation on a test system first. Ensure that backup procedures are in place before applying changes to critical management tools. Monitor user activity for unexpected behavior after the update to confirm stability. Reduce exposure by restricting who can create or modify views in the database until all clients are patched.

What to do and how to stay safe: MongoDB

• Update all instances of MongoDB Compass to version 1.49.15 or later to resolve the improper escaping vulnerability.
• Audit database views for any suspicious or unverified aggregation pipelines that could contain malicious BSON values.
• Restrict permissions for creating and editing views to trusted administrators to limit the attack surface.
• Monitor user workstations for signs of unauthorized code execution or unusual process activity after accessing database views.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-113870?

The National Vulnerability Database assigns a CVSS score of 8.8, which is classified as high severity.

Which versions of MongoDB Compass are vulnerable?

All versions of MongoDB Compass prior to 1.49.15 are affected by this vulnerability.

How is the vulnerability exploited?

An attacker creates a specially crafted view in the database, and when a user opens it for editing in Compass, arbitrary code executes.