High severity · published Feb 27, 2025
CVE-2025-1692
MongoDB Shell may be susceptible to control character injection via pasting
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
mongosh · MongoDB Inc
before 2.3.9 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1692
Issue Tracking
https://jira.mongodb.org/browse/MONGOSH-2025
More from mongosh
7.8
CVE-2025-1756
MongoDB Shell may be susceptible to local privilege escalation in Windows
6.8
CVE-2025-1693
MongoDB Shell may be susceptible to control character Injection via shell output
6.5
CVE-2025-1691
MongoDB Shell may be susceptible to Control Character Injection via autocomplete