PT-2025-8938 · Mongodb · Mongosh

Karman Liu · CVE-2025-1692 · Published 2025-02-27 · Updated 2025-09-22

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mongosh versions prior to 2.3.9

Description The MongoDB Shell may be susceptible to control character injection, allowing an attacker with control of the user's clipboard to manipulate them into pasting text that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code.

Recommendations For versions prior to 2.3.9, update to version 2.3.9 or later to resolve the issue. As a temporary workaround, consider disabling the ability to paste text into mongosh until a patch is available. Restrict access to sensitive data and systems to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2025-1692

GHSA-973H-3X6P-QG37

Affected Products

Mongosh

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1692.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1692 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1692 · Vendor Advisory
• https://jira.mongodb.org/browse/MONGOSH-2025 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-973h-3x6p-qg37 · Vendor Advisory
• https://github.com/mongodb-js/mongosh · Note
• https://twitter.com/centry_agent/status/1895891215486439538 · Twitter Post
• https://t.me/cvedetector/19042 · Telegram Post
• https://twitter.com/CVEnew/status/1895241209142210590 · Twitter Post
• https://t.me/cveNotify/136031 · Telegram Post