CVE-2025-1692

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/MONGOSH-2025	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mongodb:mongosh:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-02-27 13:15

Updated : 2025-09-22 16:40

NVD link : CVE-2025-1692

Mitre link : CVE-2025-1692

CVE.ORG link : CVE-2025-1692

JSON object : View

Products Affected

mongodb

mongosh

CWE

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2025-1692", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.3}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-02-27T13:15:11.413", "references": [{"url": "https://jira.mongodb.org/browse/MONGOSH-2025", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user\u2019s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9"}, {"lang": "es", "value": "El shell de MongoDB puede ser susceptible a la inyecci\u00f3n de caracteres de control, donde un atacante con control del portapapeles del usuario podr\u00eda manipularlo para pegar texto en Mongosh que eval\u00faa c\u00f3digo arbitrario. Los caracteres de control en el texto pegado se pueden utilizar para ofuscar c\u00f3digo malicioso. Este problema afecta a las versiones de Mongosh anteriores a la 2.3.9."}], "lastModified": "2025-09-22T16:40:56.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:mongosh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1799B29-2838-4948-BD93-2D8611DB9620", "versionEndExcluding": "2.3.9"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}