{"id":"CVE-2026-113870","title":"Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing","summary":"MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for ed…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-116"],"vendor":"MongoDB","product":"Compass","affected":["Compass >= 1.7.0 < 1.49.15"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T18:04:30.607Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113870","references":[{"url":"https://www.mongodb.com/docs/compass/release-notes/#mongodb-compass-14915"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T19:10:31.412Z","slug":"CVE-2026-113870","body":"## Overview\n\nMongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.\n\n## Affected\n\n- `Compass >= 1.7.0 < 1.49.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}