CVE-2025-1692

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-150

Affected software

VendorProductVersions
MongoDB Incmongosh< 2.3.9

References

Timeline

Published
Feb 27, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-16936.8The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inCVE-2025-16955.3In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an incCVE-2025-16965.2A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information viCVE-2025-16977.8A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions priorCVE-2025-16982.8Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial oCVE-2025-16992.8An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.CVE-2025-17007.0A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attaCVE-2025-17018.9CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a speciallyCVE-2025-17027.5The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vCVE-2025-17036.4The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, andCVE-2025-17046.5ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access tCVE-2025-17056.1The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due