medium4.3
CVE-2026-9101
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user beh…
Impact
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Compass | Versions 1.36.3, 1.36.4, 1.37.0, 1.38.0, 1.38.1, 1.38.2 |