CVE-2024-6376

—

CVSS 3.1

9.8 critical

EPSS

<1%p40

Published

Jul 1, 2024 (Jul 1, 2024)

Modified

Jun 17, 2026

Description

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

Vendors: mongodb
Products: compass
Weakness: CWE-20, CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.