Multiple vulnerabilities in MongoDB Shell



Risk Low
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2025-1691
CVE-2025-1693
CVE-2025-1692
CWE-ID CWE-74
CWE-150
Exploitation vector Network
Public exploit N/A
Vulnerable software
 MongoDB Shell
Server applications / Database software

Vendor MongoDB, Inc.

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU105118

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1691

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to control character injection via autocomplete feature. A remote administrator can input and run obfuscated malicious text to execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MongoDB Shell: 2.3.0 - 2.3.8

CPE2.3 External links

https://jira.mongodb.org/browse/MONGOSH-2024
https://github.com/advisories/GHSA-43g5-2wr2-q7vj


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Neutralization of Escape, Meta, or Control Sequences

EUVDB-ID: #VU105121

Risk: Low

CVSSv4.0: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1693

CWE-ID: CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to control character injection via shell output. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MongoDB Shell: 2.3.0 - 2.3.8

CPE2.3 External links

https://jira.mongodb.org/browse/MONGOSH-2026
https://github.com/advisories/GHSA-r95j-4jvf-mrrw


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Neutralization of Escape, Meta, or Control Sequences

EUVDB-ID: #VU105119

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1692

CWE-ID: CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to control character injection via pasting. A local administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MongoDB Shell: 2.3.0 - 2.3.8

CPE2.3 External links

https://jira.mongodb.org/browse/MONGOSH-2025
https://github.com/advisories/GHSA-973h-3x6p-qg37


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###