MongoDB for VS Code vulnerabilities

Latest MongoDB for VS Code CVEs

Newest publication first

1. CVE-2026-84967 Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

   Published 2026-09-03

   Medium·CVSS 5.1 EPSS 0.27%

   A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a...

2. CVE-2021-32039 MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text

   Published 2022-01-20

   Medium·CVSS 5.5 EPSS 0.28%

   Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension fo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.