Is CVE-2025-1692 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-1692 being exploited in the wild.

How severe is CVE-2025-1692?

Low severity, with a CVSS score of 3.1, published 27 February 2025.

Which products and versions are affected?

mongosh (npm) SEMVER:introduced=0,fixed=2.3.9.

Is there a fix for CVE-2025-1692?

Yes. mongosh (npm): upgrade to 2.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-1692 attacked?

It is attacked with local access.

Am I affected by CVE-2025-1692?

Check whether you run mongosh (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-1692: MongoDB Shell control character injection via clipboard paste

CVE-2025-1692 · Severity: low · CVSS 3.1 · Published 2025-02-27

MongoDB Shell (mongosh) is a command-line interface used by database administrators and developers to interact with MongoDB databases. An attacker who gains control of a user's clipboard could inject hidden control characters into pasted text, allowing arbitrary code to execute with the privileges of the person using the shell. This could lead to unauthorized database access, data theft, or modification.

Technologies: mongosh (npm). Vendors: npm.

Quick answers

Is CVE-2025-1692 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-1692 being exploited in the wild.
How severe is CVE-2025-1692?: Low severity, with a CVSS score of 3.1, published 27 February 2025.
Which products and versions are affected?: mongosh (npm) SEMVER:introduced=0,fixed=2.3.9.
Is there a fix for CVE-2025-1692?: Yes. mongosh (npm): upgrade to 2.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-1692 attacked?: It is attacked with local access.
Am I affected by CVE-2025-1692?: Check whether you run mongosh (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mongosh (npm): upgrade to 2.3.9 or later
```
npm install mongosh@2.3.9
```

Technical details

MongoDB Shell is vulnerable to control character injection when users paste text containing specially crafted control characters. The vulnerability (CWE-150: Improper Neutralization of Uncommon Encoding) allows an attacker with clipboard control to obfuscate malicious code by embedding control characters that cause the shell to execute unintended commands. The attack requires user interaction (pasting clipboard content) and relies on social engineering or clipboard manipulation. An attacker can achieve arbitrary code execution in the context of the mongosh user. The vulnerability affects mongosh versions prior to 2.3.9, which contains the fix.

Affected products

MongoDB mongosh prior to 2.3.9

Identifiers

CVE-2025-1692
GHSA-973h-3x6p-qg37

Timeline

2025-02-27: disclosed
2025-02-27: patched: mongosh 2.3.9 fixes the vulnerability

References

https://github.com/mongodb-js/mongosh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.