Medium severity · published May 20, 2026
CVE-2026-9101
Prototype pollution in csv parsing
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Compass · MongoDB, Inc.
1.36.3; 1.36.4; 1.37.0; 1.38.0; 1.38.1; 1.38.2; +34 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9101
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9101
Vendor Advisory
https://jira.mongodb.org/browse/COMPASS-10657
More from Compass
6.8
CVE-2026-115929
MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs