CVE-2025-1692
MongoDB Shell may be susceptible to control character injection via pasting
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
27 Feb 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
MongoDB Inc · mongoshWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →