MongoDB Compass improperly controls code generation by interpolating database names without escaping into its embedded MongoDB shell input. This allows a user with privileges to create databases on the connected server to inject code that is evaluated within the Compass process context when a Compass user opens the shell for the affected database. The vulnerability requires the Compass user to open the shell and the attacker to have database creation privileges on the server. This flaw is identified as CWE-94 (Improper Control of Generation of Code).

Successful exploitation can lead to arbitrary code execution within the Compass process with the privileges of that process. This could allow an attacker to execute commands in the context of the Compass user, potentially leading to unauthorized actions or data compromise. However, exploitation requires the attacker to have database creation privileges on the connected server and the Compass user to open the shell for the affected database, limiting the attack vector.

No official patch or fix information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening the embedded shell in Compass, especially when connected to servers where untrusted users have database creation privileges. Avoid opening the shell for databases created by untrusted users.