CVE-2025-1692
MongoDB Shell may be susceptible to control character injection via pasting
- State
- Published
- Severity
- 6.3 Medium
- Published
- Feb 27, 2025
- Updated
- Feb 27, 2025
- Reserved
- Feb 25, 2025
Description
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H | mongodb |
Weaknesses
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
Affected Products
| Product | Versions |
|---|---|
mongoshMongoDB Inc |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.