Description (CNA)
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| MongoDB / Compass | affected 1.7.0 before 1.49.15 |
CWE
CWE-116