CVE-2026-113870
High · 8.8CVSS
8.8
EPSS
—
Published
Oct 21, 2026
CISA due date
—
The record
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-116
- CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-116
- CVE-2026-104368 The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege… CWE-116
- CVE-2026-118256 Vue I18n is the internationalization plugin for Vue.js. CWE-116
- CVE-2026-118257 Vue I18n is the internationalization plugin for Vue.js. CWE-116
- CVE-2026-110910 ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array… CWE-116
- CVE-2026-116582 Seroval facilitates JavaScript value stringification, including complex structures beyond… CWE-116
- CVE-2026-55442 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-116