CVE-2026-84967 — Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the ext…
Published: 2026-09-03 · CVSS: 5.1 · CVSS 4.0
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7