CVE-2026-9101: CSV Parsing RCE Vulnerability

CVE-2026-9101 Overview

CVE-2026-9101 is a prototype pollution vulnerability in the CSV parsing logic of MongoDB Compass during import operations. An attacker who supplies a crafted CSV file can pollute object prototypes and influence untrusted file paths reaching shell.openExternal. After specific user behavior, this chain leads to 1-click command execution on the victim host. The flaw is tracked under CWE-1321, Improperly Controlled Modification of Object Prototype Attributes.

Critical Impact
A malicious CSV import combined with one user interaction can trigger execution of an attacker-controlled file path through Electron's shell.openExternal API.

Affected Products

MongoDB Compass (CSV import functionality)
Electron-based desktop client using shell.openExternal
Affected versions tracked in the MongoDB Compass Issue Tracker

Discovery Timeline

2026-05-20 - CVE-2026-9101 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-9101

Vulnerability Analysis

The vulnerability resides in the CSV parsing routine invoked during data import in MongoDB Compass. The parser constructs JavaScript objects from CSV column headers and row values without sanitizing reserved keys such as __proto__ or constructor.prototype. A crafted CSV file can therefore inject properties into Object.prototype, which subsequently influences unrelated code paths in the application.

One of those code paths terminates in a call to Electron's shell.openExternal. While the attacker cannot directly control command-line arguments, they can control the file path passed to this API. The vulnerability requires user interaction, consistent with the UI:P component of the CVSS 4.0 vector.

Root Cause

The root cause is unsafe property assignment during CSV-to-object conversion. The parser treats every CSV header as a writable key on a fresh object, allowing keys like __proto__.<x> to mutate the global prototype. Downstream code that later reads properties on plain objects unexpectedly retrieves attacker-controlled values, including a file path consumed by shell.openExternal.

Attack Vector

The attack requires the victim to import an attacker-supplied CSV file into MongoDB Compass and to perform a follow-up UI action that triggers the polluted code path. Because shell.openExternal resolves certain paths through the operating system shell, opening a controlled local executable or protocol handler can result in command execution. Refer to the MongoDB Compass Issue Tracker for vendor technical details.

No verified exploit code is published. The vulnerability mechanism is described above in prose.

Detection Methods for CVE-2026-9101

Indicators of Compromise

CSV files containing literal header tokens such as __proto__, constructor, or prototype imported into MongoDB Compass
Child processes spawned by the Compass renderer or main process invoking cmd.exe, powershell.exe, open, or xdg-open shortly after a CSV import
Unexpected outbound network connections originating from processes launched by the Compass executable

Detection Strategies

Inspect CSV files staged on user workstations for prototype-pollution sentinel keys before they are opened in Compass
Alert on process lineage where MongoDB Compass spawns shell interpreters or document handlers, which is not part of normal usage
Correlate file-open events for .csv documents in Compass with subsequent ShellExecute-class API activity on the host

Monitoring Recommendations

Log and review Electron shell.openExternal invocations where instrumentation is available
Monitor endpoint telemetry for Compass child processes resolving paths outside the user's Documents or Downloads directories
Track CSV imports originating from email attachments, external file shares, or browser downloads

How to Mitigate CVE-2026-9101

Immediate Actions Required

Upgrade MongoDB Compass to the fixed release referenced in COMPASS-10657
Restrict CSV imports in Compass to files originating from trusted internal sources until patching is complete
Educate database administrators on the 1-click nature of the chain and the required follow-up UI interaction

Patch Information

MongoDB has tracked the fix under issue COMPASS-10657. Apply the vendor-supplied update that hardens CSV parsing against prototype pollution and constrains the file paths passed to shell.openExternal. Consult the MongoDB Compass Issue Tracker for the specific fixed version.

Workarounds

Avoid importing CSV files received from untrusted or external sources into MongoDB Compass
Use mongoimport from the command line as an alternative for ingesting CSV data when feasible
Run Compass under a least-privileged user account to limit the impact of any command executed through shell.openExternal

bash

# Verify installed MongoDB Compass version before and after patching
# macOS
/Applications/MongoDB\ Compass.app/Contents/MacOS/MongoDB\ Compass --version

# Linux
mongodb-compass --version

# Windows (PowerShell)
Get-Item "$env:LOCALAPPDATA\MongoDBCompass\MongoDBCompass.exe" | Select-Object VersionInfo