PT-2026-42301 · Cleanstart · Mongosh

Published 2026-04-16 · Updated 2026-04-16

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Multiple security vulnerabilities affect the mongosh package. Axios is a promise based HTTP client for the browser and Node. See references for individual vulnerability details.

Fix

Related Identifiers

CLEANSTART-2026-TW25027

Affected Products

Mongosh

References · 45

• https://nvd.nist.gov/vuln/detail/CVE-2025-62718 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33750 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-TW25027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2950 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21637 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-25285 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33937 · Security Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TW25027.json · Note
• https://osv.dev/vulnerability/CVE-2026-4926 · Note
• https://osv.dev/vulnerability/CVE-2025-25285 · Note
• https://osv.dev/vulnerability/ghsa-j3q9-mxjg-w52f · Note