CVE-2026-9101 - Prototype pollution in csv parsing

Back Back to CVE browser

MEDIUM

Prototype pollution in csv parsing

Published May 20, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.45%

Description

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

Affected products

Vendor MongoDB, Inc. Product Compass Default
unaffected
- Version
  1.36.3
  Status
  affected
  Constraints
  -
- Version
  1.36.4
  Status
  affected
  Constraints
  -
- Version
  1.37.0
  Status
  affected
  Constraints
  -
- Version
  1.38.0
  Status
  affected
  Constraints
  -
- Version
  1.38.1
  Status
  affected
  Constraints
  -
- Version
  1.38.2
  Status
  affected
  Constraints
  -
- Version
  1.39.0
  Status
  affected
  Constraints
  -
- Version
  1.39.1
  Status
  affected
  Constraints
  -
- Version
  1.39.2
  Status
  affected
  Constraints
  -
- Version
  1.39.3
  Status
  affected
  Constraints
  -
- Version
  1.39.4
  Status
  affected
  Constraints
  -
- Version
  1.40.0
  Status
  affected
  Constraints
  -
- Version
  1.40.1
  Status
  affected
  Constraints
  -
- Version
  1.40.2
  Status
  affected
  Constraints
  -
- Version
  1.40.3
  Status
  affected
  Constraints
  -
- Version
  1.40.4
  Status
  affected
  Constraints
  -
- Version
  1.41.0
  Status
  affected
  Constraints
  -
- Version
  1.42.0
  Status
  affected
  Constraints
  -
- Version
  1.42.1
  Status
  affected
  Constraints
  -
- Version
  1.42.2
  Status
  affected
  Constraints
  -
- Version
  1.42.3
  Status
  affected
  Constraints
  -
- Version
  1.42.5
  Status
  affected
  Constraints
  -
- Version
  1.43.0
  Status
  affected
  Constraints
  -
- Version
  1.43.1
  Status
  affected
  Constraints
  -
- Version
  1.43.2
  Status
  affected
  Constraints
  -
- Version
  1.43.3
  Status
  affected
  Constraints
  -
- Version
  1.43.4
  Status
  affected
  Constraints
  -
- Version
  1.43.5
  Status
  affected
  Constraints
  -
- Version
  1.43.6
  Status
  affected
  Constraints
  -
- Version
  1.44.0
  Status
  affected
  Constraints
  -
- Version
  1.44.3
  Status
  affected
  Constraints
  -
- Version
  1.44.4
  Status
  affected
  Constraints
  -
- Version
  1.44.5
  Status
  affected
  Constraints
  -
- Version
  1.44.6
  Status
  affected
  Constraints
  -
- Version
  1.44.7
  Status
  affected
  Constraints
  -
- Version
  1.45.0
  Status
  affected
  Constraints
  -
- Version
  1.45.1
  Status
  affected
  Constraints
  -
- Version
  1.45.2
  Status
  affected
  Constraints
  -
- Version
  1.45.3
  Status
  affected
  Constraints
  -
- Version
  1.45.4
  Status
  affected
  Constraints
  -
- Version
  1.46.0
  Status
  affected
  Constraints
  -
- Version
  1.46.1
  Status
  affected
  Constraints
  -
- Version
  1.46.10
  Status
  affected
  Constraints
  -
- Version
  1.46.11
  Status
  affected
  Constraints
  -
- Version
  1.46.2
  Status
  affected
  Constraints
  -
- Version
  1.46.3
  Status
  affected
  Constraints
  -
- Version
  1.46.4
  Status
  affected
  Constraints
  -
- Version
  1.46.5
  Status
  affected
  Constraints
  -
- Version
  1.46.6
  Status
  affected
  Constraints
  -
- Version
  1.46.7
  Status
  affected
  Constraints
  -
- Version
  1.46.8
  Status
  affected
  Constraints
  -
- Version
  1.46.9
  Status
  affected
  Constraints
  -
- Version
  1.47.0
  Status
  affected
  Constraints
  -
- Version
  1.47.1
  Status
  affected
  Constraints
  -
- Version
  1.48.0
  Status
  affected
  Constraints
  -
- Version
  1.48.1
  Status
  affected
  Constraints
  -
- Version
  1.48.2
  Status
  affected
  Constraints
  -
- Version
  1.49.0
  Status
  affected
  Constraints
  -
- Version
  1.49.1
  Status
  affected
  Constraints
  -
- Version
  1.49.2
  Status
  affected
  Constraints
  -
- Version
  1.49.3
  Status
  affected
  Constraints
  -
- Version
  1.49.4
  Status
  affected
  Constraints
  -
- Version
  1.49.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MongoDB, Inc.

Compass

unaffected

Version	Status	Constraints
1.36.3	affected	-
1.36.4	affected	-
1.37.0	affected	-
1.38.0	affected	-
1.38.1	affected	-
1.38.2	affected	-
1.39.0	affected	-
1.39.1	affected	-
1.39.2	affected	-
1.39.3	affected	-
1.39.4	affected	-
1.40.0	affected	-
1.40.1	affected	-
1.40.2	affected	-
1.40.3	affected	-
1.40.4	affected	-
1.41.0	affected	-
1.42.0	affected	-
1.42.1	affected	-
1.42.2	affected	-
1.42.3	affected	-
1.42.5	affected	-
1.43.0	affected	-
1.43.1	affected	-
1.43.2	affected	-
1.43.3	affected	-
1.43.4	affected	-
1.43.5	affected	-
1.43.6	affected	-
1.44.0	affected	-
1.44.3	affected	-
1.44.4	affected	-
1.44.5	affected	-
1.44.6	affected	-
1.44.7	affected	-
1.45.0	affected	-
1.45.1	affected	-
1.45.2	affected	-
1.45.3	affected	-
1.45.4	affected	-
1.46.0	affected	-
1.46.1	affected	-
1.46.10	affected	-
1.46.11	affected	-
1.46.2	affected	-
1.46.3	affected	-
1.46.4	affected	-
1.46.5	affected	-
1.46.6	affected	-
1.46.7	affected	-
1.46.8	affected	-
1.46.9	affected	-
1.47.0	affected	-
1.47.1	affected	-
1.48.0	affected	-
1.48.1	affected	-
1.48.2	affected	-
1.49.0	affected	-
1.49.1	affected	-
1.49.2	affected	-
1.49.3	affected	-
1.49.4	affected	-
1.49.5	affected	-