{
  "cveId": "CVE-2024-6376",
  "url": "https://patchblox.com/security/cve/CVE-2024-6376",
  "summary": "CVE-2024-6376 is fixed in 3 products on 1 platform, first by MongoDB Compass 1.42.2.0, released February 29, 2024. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "ejson shell parser in MongoDB Compass maybe bypassed",
  "description": "MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2",
  "published": "2024-07-01T15:15:17Z",
  "severity": "",
  "cvss": 9.8,
  "cwe": "CWE-20: Improper Input Validation",
  "epss": 0.0048,
  "epssPercentile": 0.41695,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2024-6376",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "MongoDB Compass",
      "fixedVersion": "1.42.2.0",
      "fix": "MongoDB Compass 1.42.2.0",
      "url": "https://patchblox.com/security/fix/windows-app/mongodb.compass.full-1.42.2.0",
      "released": "2024-02-29T00:00:00Z"
    },
    {
      "platform": "windows-app",
      "product": "MongoDB Compass Isolated Edition",
      "fixedVersion": "1.42.2.0",
      "fix": "MongoDB Compass Isolated Edition 1.42.2.0",
      "url": "https://patchblox.com/security/fix/windows-app/mongodb.compass.isolated-1.42.2.0",
      "released": "2024-02-29T00:00:00Z"
    },
    {
      "platform": "windows-app",
      "product": "MongoDB Compass Readonly",
      "fixedVersion": "1.42.2.0",
      "fix": "MongoDB Compass Readonly 1.42.2.0",
      "url": "https://patchblox.com/security/fix/windows-app/mongodb.compass.readonly-1.42.2.0",
      "released": "2024-02-29T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}