What is GHSA-jxr4-4prv-mh83?

GHSA-jxr4-4prv-mh83 is a security advisory published by GitHub Security Advisories with High severity. ejson shell parser in MongoDB Compass maybe bypassed

Which CVE IDs does GHSA-jxr4-4prv-mh83 cover?

GHSA-jxr4-4prv-mh83 covers the following CVE IDs: CVE-2024-6376. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jxr4-4prv-mh83?

GHSA-jxr4-4prv-mh83 has a CVSS v3 base score of 7.0, published by GitHub Security Advisories.

Which products are affected by GHSA-jxr4-4prv-mh83?

GHSA-jxr4-4prv-mh83 affects 1 product, including: npm/@mongodb-js/connection-form:\u003c 1.20.1.

GHSA-jxr4-4prv-mh83HighCVSS 7.0

ejson shell parser in MongoDB Compass maybe bypassed

Vendor

GitHub Security Advisories

Published

July 1, 2024

Last Modified

February 27, 2025

🔗 CVE IDs covered (1)

CVE-2024-6376 →

📋 Description

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2.

🎯 Affected products1

npm/@mongodb-js/connection-form:< 1.20.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-6376
https://jira.mongodb.org/browse/COMPASS-7496
https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51
https://github.com/advisories/GHSA-jxr4-4prv-mh83