CVE-2025-1693: MongoDB Shell control character injection via shell output

CVE-2025-1693 · Severity: low · CVSS 3.1 · Published 2025-02-27

MongoDB Shell (mongosh) is the command-line interface used by database administrators and developers to interact with MongoDB databases. An attacker who controls database contents can inject control characters into the shell output to display falsified system or application messages, potentially tricking users into executing unsafe commands. This requires the attacker to already have partial or full control over the MongoDB cluster.

Technologies: mongosh (npm). Vendors: npm.

Quick answers

Is CVE-2025-1693 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-1693 being exploited in the wild.
How severe is CVE-2025-1693?
Low severity, with a CVSS score of 3.1, published 27 February 2025.
Which products and versions are affected?
mongosh (npm) SEMVER:introduced=0,fixed=2.3.9.
Is there a fix for CVE-2025-1693?
Yes. mongosh (npm): upgrade to 2.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-1693 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-1693?
Check whether you run mongosh (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mongosh (npm): upgrade to 2.3.9 or later
    npm install mongosh@2.3.9

Technical details

The vulnerability is a control character injection issue (CWE-150) in the MongoDB Shell output rendering. An attacker with control over database cluster contents can inject malicious control characters that, when displayed by mongosh, produce falsified messages appearing to originate from mongosh or the operating system. The attack requires the shell to be connected to an attacker-controlled or partially controlled MongoDB cluster, and relies on user interaction to be effective. Mongosh versions prior to 2.3.9 are affected; patched version 2.3.9 and later are available.

Affected products

  • MongoDB mongosh prior to 2.3.9

Identifiers

  • CVE-2025-1693
  • GHSA-r95j-4jvf-mrrw

Timeline

  • 2025-02-27: disclosed
  • 2025-02-27: patched: Fix available in mongosh 2.3.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.