The MongoDB extension for Visual Studio Code contains a command injection vulnerability (CVE-2026-84967) due to improper sanitization of special characters in a connection string. When the extension constructs a command line for its integrated terminal shell feature, it inserts the connection string without neutralizing shell metacharacters. An unauthenticated attacker can trick a developer into accepting a malicious connection string and opening the shell, leading to arbitrary command execution on the developer's machine. No privileges are required on the developer's system, but multiple user actions are necessary. The confirmation dialog does not display the injected content, increasing the risk of unnoticed exploitation. The vulnerability affects versions >=1.13.0 and <1.17.1. A patch is available to fix this issue.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on a developer's machine via the MongoDB extension's shell feature in Visual Studio Code. This could lead to compromise of the developer's environment. However, exploitation requires social engineering to convince the developer to accept a malicious connection string and open the shell feature. There is no indication of active exploitation in the wild.

A patch is available for this vulnerability; users should upgrade the MongoDB extension for Visual Studio Code to version 1.17.1 or later. Until patched, developers should avoid accepting untrusted connection strings and refrain from opening the shell feature with user-supplied connection targets. The vendor advisory should be consulted for the official fix and update instructions.