CVE-2025-1755 MongoDB Compass may be susceptible to local privilege escalation in Windows
MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1
Problem types: cwe_id: CWE-426
description: CWE-426: Untrusted Search Path
Affected products: vendor: MongoDB Inc
product: MongoDB Compass
cpes: cpe:2.3:a:mongodb:compass:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.8:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.9:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.10:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.11:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.12:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.13:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.14:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.15:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.16:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.17:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.18:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.19:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.20:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.21:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.22:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.23:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.24.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.25.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.26.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.26.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.28.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.28.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.29.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.29.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.29.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.30.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.31.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.31.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.31.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.31.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.32.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.32.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.32.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.32.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.33.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.33.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.34.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.34.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.35.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.36.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.36.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.41.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: T. Doğa Gelişli
Published: 2025-02-27T15:24:07.174Z