CVE-2026-84967Medium· 4.3▾ SunlitA component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticat…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.
mongodb >= 1.13.0, < 1.17.1Upgrade past the affected range:
mongodb 1.17.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82052Medium· 6.5The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod)
CVE-2026-82053High· 8.1A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations
CVE-2026-82054Medium· 6.5A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing
CVE-2026-82055Medium· 6.5A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference
CVE-2026-82056Medium· 5.3A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths
CVE-2026-82057Medium· 6.5A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process