CVE-2025-1692 MongoDB Shell may be susceptible to control character injection via pasting
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
Problem types: cwe_id: CWE-150
description: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Affected products: vendor: MongoDB Inc
product: mongosh
cpes: cpe:2.3:a:mongodb:mongosh:0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.7.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.9.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.10.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.11.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.12.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.14.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.8:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.9:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.90:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.91:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.9:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.10:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.11:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.12:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.15:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.3.8:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-02-27T12:37:00.376Z