LeafBase is an open-source Mongo DB client that is fast and easy to use, built using Electron and React. It has native support for MongoDB 4.4 to 8.0+, with additional features for SSH Tunneling, TLS/SSL and a full featured results viewer (Tree, Table, JSON). Created for speed, beauty, and reliability, LeafBase is a polished experience for DBAs and developers alike - completely free, no paywalls, no feature tiers.
Latest updates
v1.1.3
LatestLeafBase v1.1.3yesterdayfix(security): patch command injection, open-handler, and auto-update risks
bsonTools: replace exec() with execFile() when extracting tar archives so
userData paths containing spaces or shell metacharacters can't be
interpreted as commands.
main window: allowlist http(s)/mailto in setWindowOpenHandler to prevent
file:// or custom-scheme URLs from triggering arbitrary handlers via
shell.openExternal.
autoUpdater: only enable on macOS, where builds are signed/notarized.
Windows/Linux builds are unsigned, so auto-downloading installers would
be a supply-chain RCE vector until code-signing is in place.
bsonTools: replace exec() with execFile() when extracting tar archives so
userData paths containing spaces or shell metacharacters can't be
interpreted as commands.
main window: allowlist http(s)/mailto in setWindowOpenHandler to prevent
file:// or custom-scheme URLs from triggering arbitrary handlers via
shell.openExternal.
autoUpdater: only enable on macOS, where builds are signed/notarized.
Windows/Linux builds are unsigned, so auto-downloading installers would
be a supply-chain RCE vector until code-signing is in place.
More from Vu tran
LeafBase
A cross-platform MongoDB GUI the open-source successor to Robo3T
65
Reviews & comments