GitHub Advisoryadvisory · npm

GHSA-jxr4-4prv-mh83 ejson shell parser in MongoDB Compass maybe bypassed

HIGH Published 2024-07-01 Modified 2025-02-27 Official page ↗
Aliases
CVE-2024-6376
Ecosystem
npm
Packages
@mongodb-js/connection-form
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-94
Reviewed
2025-02-27

Affected packages

• npm @mongodb-js/connection-form: < 1.20.1 → fixed in 1.20.1

Description

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2.

Related

Alias · CVE (1)

  • CVE-2024-6376 MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References