Executive brief
MongoDB Shell (mongosh) is the command-line interface used by database administrators and developers to interact with MongoDB databases. An attacker who controls database contents can inject control characters into the shell output to display falsified system or application messages, potentially tricking users into executing unsafe commands. This requires the attacker to already have partial or full control over the MongoDB cluster.
Technical details
The vulnerability is a control character injection issue (CWE-150) in the MongoDB Shell output rendering. An attacker with control over database cluster contents can inject malicious control characters that, when displayed by mongosh, produce falsified messages appearing to originate from mongosh or the operating system. The attack requires the shell to be connected to an attacker-controlled or partially controlled MongoDB cluster, and relies on user interaction to be effective. Mongosh versions prior to 2.3.9 are affected; patched version 2.3.9 and later are available.
Affected products
- MongoDB mongosh prior to 2.3.9
Timeline
- 2025-02-27: disclosed
- 2025-02-27: patched: Fix available in mongosh 2.3.9