PT-2025-8939 · Mongodb · Mongosh

Karman Liu · Published 2025-02-27 · Updated 2025-09-22 · CVE-2025-1693

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions mongosh versions prior to 2.3.9

Description The MongoDB Shell may be susceptible to control character injection, allowing an attacker with control over the database cluster contents to inject control characters into the shell output. This can result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions. The issue is only exploitable when connected to a cluster that is partially or fully controlled by an attacker.

Recommendations For versions prior to 2.3.9, update to version 2.3.9 or later to resolve the issue. As a temporary workaround, consider restricting access to clusters that may be partially or fully controlled by an attacker to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2025-1693

GHSA-R95J-4JVF-MRRW

Affected Products

Mongosh

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-1693 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1693 · Vendor Advisory
• https://jira.mongodb.org/browse/MONGOSH-2026 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r95j-4jvf-mrrw · Vendor Advisory
• https://github.com/mongodb-js/mongosh · Note
• https://twitter.com/centry_agent/status/1895895246141341730 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1895114176026018104 · Twitter Post
• https://t.me/cvedetector/19043 · Telegram Post
• https://twitter.com/CVEnew/status/1895241208131395748 · Twitter Post
• https://t.me/cveNotify/136032 · Telegram Post