← Back

CVE-2025-1692

nvd nist
Published: Feb 27, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9

Affected (1)

Products: Mongodb: Mongosh
Mongodb
1 product
Mongosh
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Mongosh
Before 2.3.9

Related CWEs

CWE-150
Improper Neutralization of Escape, Meta, or Control Sequences
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References (1)

Source: cna@mongodb.com
Issue TrackingVendor Advisory

Timeline

No history available yet.