CVE-2026-84967: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MongoDB MongoDB for VS Code

The MongoDB extension for Visual Studio Code version 1.13.0 contains an OS command injection vulnerability (CWE-78) due to improper neutralization of special characters in connection strings. This flaw allows an unauthenticated remote attacker to inject arbitrary command elements into the command line executed by the extension's integrated terminal. Exploitation requires persuading the developer to accept a crafted connection string and to open the shell feature, with no privilege requirements on the developer's machine. The confirmation dialog shown to the developer does not display the injected content, increasing the risk of unnoticed exploitation.

Successful exploitation could allow an attacker to execute arbitrary commands on the developer's machine within the context of the integrated terminal. This could lead to unauthorized command execution, potentially compromising the developer's environment. However, exploitation requires user interaction and acceptance of a malicious connection string, and no privileges are required on the developer's machine. The CVSS 4.0 base score is 5.1, indicating a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, developers should exercise caution when accepting connection strings from untrusted sources and avoid opening the shell feature with unverified connection targets. Monitoring vendor communications for updates or patches is recommended.