{"action":"Upgrade @mongodb-js/connection-form to 1.20.1 or later.","affected":[{"fixed":"1.20.1","introduced":"0"}],"component":"@mongodb-js/connection-form","cve_ids":["CVE-2024-6376"],"ecosystem":"npm","epss":0.0048,"exploited":false,"fixed_versions":["1.20.1"],"ghsa_id":"GHSA-jxr4-4prv-mh83","id":"tcs_01M5KFZ7HHZW7JJS32K6ZQXQX2","modified_at":"2025-02-27T21:12:20.202391Z","published_at":"2024-07-01T15:32:47Z","references":["https://osv.dev/vulnerability/GHSA-jxr4-4prv-mh83","https://nvd.nist.gov/vuln/detail/CVE-2024-6376","https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51","https://github.com/mongodb-js/compass","https://jira.mongodb.org/browse/COMPASS-7496"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"GHSA-jxr4-4prv-mh83","url":"https://osv.dev/vulnerability/GHSA-jxr4-4prv-mh83"}],"summary":"ejson shell parser in MongoDB Compass maybe bypassed"}