Is CVE-2026-84967 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84967?

CVE-2026-84967 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-84967

Description

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.