Control Character Injection Vulnerability in MongoDB Shell by MongoDB

CVE-2025-1691

What is CVE-2025-1691?

The MongoDB Shell presents a control character injection vulnerability that allows an attacker to manipulate the autocompletion feature. If a user unwittingly engages the autocomplete function by pressing 'tab', they can execute previously obfuscated malicious commands. This exploitation is contingent on the MongoDB Shell being connected to a cluster that the attacker controls, either partially or fully. Versions of mongosh prior to 2.3.9 are particularly susceptible to this vulnerability.

References