This vulnerability involves improper control of object prototype attributes (CWE-1321) in the CSV import functionality of MongoDB Compass. Specifically, prototype pollution in the CSV parsing logic can cause untrusted file paths to be passed to shell.openExternal after certain user interactions, resulting in a potential '1-click' command execution scenario. The issue affects a wide range of Compass versions from 1.36.3 to 1.49.5. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity. No vendor advisory or patch information is currently available.

An attacker can exploit this vulnerability by crafting a malicious CSV file that, when imported by a user in MongoDB Compass, causes untrusted file paths to be opened via shell.openExternal. This can lead to execution of commands with the user's privileges after a single click, potentially compromising the user's environment. The impact is limited by the need for user interaction and the low integrity impact as per the CVSS vector. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when importing CSV files from untrusted sources and avoid opening unexpected external links triggered by the application. Monitor MongoDB's official channels for updates regarding patches or mitigations.