Executive brief
MongoDB Shell (mongosh) is a command-line interface used by database administrators and developers to interact with MongoDB databases. An attacker who gains control of a user's clipboard could inject hidden control characters into pasted text, allowing arbitrary code to execute with the privileges of the person using the shell. This could lead to unauthorized database access, data theft, or modification.
Technical details
MongoDB Shell is vulnerable to control character injection when users paste text containing specially crafted control characters. The vulnerability (CWE-150: Improper Neutralization of Uncommon Encoding) allows an attacker with clipboard control to obfuscate malicious code by embedding control characters that cause the shell to execute unintended commands. The attack requires user interaction (pasting clipboard content) and relies on social engineering or clipboard manipulation. An attacker can achieve arbitrary code execution in the context of the mongosh user. The vulnerability affects mongosh versions prior to 2.3.9, which contains the fix.
Affected products
- MongoDB mongosh prior to 2.3.9
Timeline
- 2025-02-27: disclosed
- 2025-02-27: patched: mongosh 2.3.9 fixes the vulnerability