{"id":"CVE-2026-113870","summary":"Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing","details":"MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.","modified":"2026-10-22T02:49:10.669366672Z","published":"2026-10-21T18:04:30.607Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113870.json","cna_assigner":"mongodb","cwe_ids":["CWE-116"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113870.json"},{"type":"PACKAGE","url":"https://github.com/mongodb-js/compass"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113870"},{"type":"WEB","url":"https://www.mongodb.com/docs/compass/release-notes/#mongodb-compass-14915"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mongodb-js/compass","events":[{"introduced":"f931679d78ccfbaeead6e3b788c29910aff34709"},{"fixed":"4cd3dc195957fcaaf46a35b9fd16cbe98afe2f3c"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"1.7.0"},{"fixed":"1.49.15"}],"source":"AFFECTED_FIELD"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113870.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}