Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execu…

Medium CVSS 4.3

CVECVE-2026-9101

First seen2026-07-23 12:31 UTC

Disclosed2026-05-20 17:16 UTC

Last updated2026-07-23 12:31 UTC

Channel statusauto

Summary

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://jira.mongodb.org/browse/COMPASS-10657

Timeline

2026-07-23 nvd_ingest NVD