---
id: CVE-2026-84967
title: >-
  A component of the MongoDB extension for Visual Studio Code does not
  neutralize special characters in a connection string before that value is
  placed into a command line the extension composes for an integrated terminal
summary: >-
  A component of the MongoDB extension for Visual Studio Code does not
  neutralize special characters in a connection string before that value is
  placed into a command line the extension composes for an integrated terminal.
  An unauthenticat…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-78
vendor: mongodb
product: mongodb
affected:
  - 'mongodb >= 1.13.0, < 1.17.1'
patched:
  - mongodb 1.17.1
published: '2026-09-03'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T19:51:55.640'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84967'
references:
  - url: 'https://jira.mongodb.org/browse/VSCODE-798'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-03T15:30:45.994921Z'
ingestedAt: '2026-09-10T20:30:36.362Z'
epss: 0.00267
epssPercentile: 0.16745
---

## Overview

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

## Affected

- `mongodb >= 1.13.0, < 1.17.1`

## Remediation

Upgrade past the affected range:

- `mongodb 1.17.1`