CVE-2025-1692CWE-150

MongoDB Shell may be susceptible to control character injection via pasting

Medium · published February 27, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences
Published
2025-02-27T12:37Z
EPSS history
Timeline
  • 27 FEB 12:37Z
    MongoDB Shell may be susceptible to control character injection via pasting
    cvelistv5