The vulnerability CVE-2026-14881 in MongoDB Compass 1.38.0 allows an attacker to inject OS commands by overriding connection options during the import of connections. The flaw specifically enables setting a custom browser open command for the OIDC authentication flow, bypassing intended restrictions. This improper neutralization of special elements used in OS commands (CWE-78) can be exploited to execute arbitrary OS commands with the privileges of the Compass application user. The CVSS 4.0 base score is 8.4, indicating high severity. There is no official remediation or patch available as of the published date, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands on the system running MongoDB Compass 1.38.0. This can lead to compromise of the local system environment, data exposure, or further attacks depending on the privileges of the Compass application user. The vulnerability affects local attack vectors with low complexity and requires no privileges but does require user interaction. The impact on confidentiality, integrity, and availability is high.

No official patch or remediation is currently available for this vulnerability. Users should avoid importing untrusted connection configurations in MongoDB Compass version 1.38.0. Monitor the vendor's advisory channels for updates or official fixes. Until a fix is released, restrict usage of Compass to trusted environments and consider alternative methods for connection management that do not involve importing potentially malicious configurations.