CVE-2025-1693

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions.

The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.

This issue affects mongosh versions prior to 2.3.9

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-150

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-16955.3In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an inc CVE-2025-16965.2A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information vi CVE-2025-16977.8A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior CVE-2025-16982.8Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial o CVE-2025-16992.8An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.CVE-2025-17007.0A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local atta CVE-2025-17018.9CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially CVE-2025-17027.5The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v CVE-2025-17036.4The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and CVE-2025-17046.5ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access t CVE-2025-17056.1The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due CVE-2025-17067.5Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.