A critical OS command injection vulnerability in MongoDB Compass allows attackers to execute arbitrary commands by manipulating connection import options.

This vulnerability is an OS command injection flaw (CWE-78) triggered when importing connection files. The application fails to properly neutralize special elements, allowing an attacker to override restricted connection parameters and execute unauthorized commands on the host system.

Successful exploitation of this vulnerability could allow an attacker to gain full control over the host running MongoDB Compass. Given the CVSS score of 7.8, this poses a significant risk to the integrity and availability of local development environments and potentially connected infrastructure. Unauthorized command execution may lead to data exfiltration or the installation of persistent malicious software.

Immediate Action: Update MongoDB Compass to version 1.49.7 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review system logs for unusual process creation or unauthorized command-line arguments originating from the MongoDB Compass application.

Compensating Controls: Restrict the ability of users to import external connection configuration files from untrusted sources until the software has been updated.

Public Exploit Available: Unknown

The severity of this command injection vulnerability necessitates immediate action. Administrators and developers should prioritize updating all instances of MongoDB Compass to version 1.49.7 to prevent potential system compromise and unauthorized remote code execution.