{"id":"CVE-2026-14881","summary":"Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow","details":"When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.","modified":"2026-08-12T03:51:35.116461007Z","published":"2026-07-22T19:23:17.455Z","database_specific":{"cna_assigner":"mongodb","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14881.json"},"references":[{"type":"WEB","url":"https://github.com/mongodb-js/compass/releases/tag/v1.49.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14881.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14881"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mongodb-js/compass","events":[{"introduced":"92a83ce4304f35618d28dc85df8f498d4d2a4689"},{"fixed":"32d69fea785e04dd7e4a4403ca754cda4b81398c"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"1.38.0"},{"fixed":"1.49.7"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14881.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}