CVE-2025-1756 MongoDB Shell may be susceptible to local privilege escalation in Windows
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
Problem types: cwe_id: CWE-426
description: CWE-426: Untrusted Search Path
Affected products: vendor: MongoDB Inc
product: mongosh
cpes: cpe:2.3:a:mongodb:mongosh:0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.7.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.9.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.10.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.11.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.12.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.14.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.8:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.9:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.90:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.91:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.9:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.10:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.11:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.12:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.15:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: T. Doğa Gelişli
Published: 2025-02-27T15:28:11.633Z